Free Cisco CCNA 200-301 v2.0 Practice Exam

Upcoming exam: v2.0 testing starts February 3, 2027. Testing earlier? Use CCNA v1.1 .

Original IT Mastery practice questions, independently written and selected from the app question bank. They are not official Cisco questions or copied exam content.

How to use this practice set

Work through all 100 questions before revealing explanations. This is an editorial practice length, not a fixed Cisco item count or a reproduction of hands-on lab tasks. Cisco specifies 120 minutes for the exam; you may use that as a practice time budget, but this set is not an equivalent live exam form.

Each question has one best answer. Award one point for the keyed choice. The single-answer format reflects this public selection, not a claim about every item type on the Cisco exam.

Answer choices were shuffled when this page was generated. Explanations use the displayed letters; refreshing the page keeps the same order. Record your reasoning as well as your choice.

Practice-set coverage

Practice questions

Questions 1-25

Question 1

Topic: Network Infrastructure and Connectivity

Two virtual machines run on the same hypervisor host and should both be in VLAN 10. App1 can reach its default gateway, but App2 cannot.

Exhibit:

The host physical uplink is up, and its switch trunk allows VLANs 10 and 20. What is the best corrective action?

Options:

• A. Move App2’s vNIC to the VLAN 10 port group.

• B. Remove VLAN 20 from the physical switch trunk.

• C. Replace the host physical NIC or cable.

• D. Configure one shared guest OS for both VMs.

Best answer: A

Explanation: A hypervisor lets multiple VMs share the same physical host while keeping each VM’s guest operating system and virtual NIC logically separate. Here, the physical uplink is not the likely fault because App1 uses the same host and can reach the gateway. App2 also has an IP address and default gateway in VLAN 10, but its vNIC is connected to a VLAN 20 port group. The supported fix is to attach App2’s vNIC to the VLAN 10 port group so its virtual switch path matches its guest IP subnet.

The key takeaway is that VM network failures can affect one VM only when that VM’s own vNIC or port group mapping is wrong.

• Physical NIC fault is unlikely because another VM on the same host successfully uses the uplink.
• Shared guest OS misunderstands virtualization; VMs keep separate guest operating systems.
• Removing VLAN 20 does not place App2 in VLAN 10 and could break valid VLAN 20 traffic.

Question 2

Topic: IP Routing

Hosts in VLAN 30 receive DHCP addresses in 10.30.0.0/24 with default gateway 10.30.0.1, but they cannot ping the gateway. The distribution switches use HSRP for the VLAN.

Exhibit:

DSW1# show standby brief
Interface  Grp  Pri  State   Active   Standby  Virtual IP
Vl30       30   110  Active  local    10.30.0.3 10.30.0.1

DSW2# show standby brief
Interface  Grp  Pri  State    Active    Standby  Virtual IP
Vl30       30   100  Standby  10.30.0.2 local    10.30.0.1

DSW1# show ip interface brief | include Vlan30
Vlan30  10.30.0.2  YES manual up up

Which validation step should the engineer perform first?

Options:

• A. Clear the DHCP bindings for VLAN 30

• B. Verify the OSPF neighbor state

• C. Verify VLAN 30 on the access trunks

• D. Change the HSRP virtual IP address

Best answer: C

Explanation: The HSRP output shows a normal active/standby relationship and the expected virtual IP address, and the SVI on DSW1 is up/up. Because the hosts have valid DHCP addressing but cannot ping their local default gateway, the most likely area to validate next is Layer 2 connectivity for VLAN 30 between the access layer and the distribution switches. A missing or nonforwarding VLAN on a trunk can prevent hosts from reaching the HSRP virtual MAC/IP even when HSRP itself is operating correctly.

The key takeaway is to prove local VLAN reachability to the FHRP gateway before troubleshooting routing beyond the gateway.

• OSPF state is beyond the default gateway path and would not explain failure to ping the local gateway.
• DHCP bindings are not the first issue because clients already received the correct subnet and gateway.
• Changing the VIP is unsupported because both HSRP peers agree on 10.30.0.1.

Question 3

Topic: Network Services and Security

R1 uses PAT for LAN clients. A SaaS partner asks which source address and TCP source port to allow on its firewall for the active HTTPS session from PC1 (10.10.10.25) shown below. Which value should be provided?

Exhibit: R1 NAT table

Pro  Inside global        Inside local         Outside local       Outside global
tcp  203.0.113.10:49172   10.10.10.25:51514   198.51.100.50:443  198.51.100.50:443

Options:

• A. 10.10.10.25 source port 51514

• B. 203.0.113.10 source port 49172

• C. 198.51.100.50 source port 443

• D. 203.0.113.10 source port 51514

Best answer: B

Explanation: In an IOS XE NAT translation table, inside local is the original private address and port of the inside host. Inside global is the translated address and port used on the outside network. With PAT, the router may translate both the source IP address and the source TCP/UDP port so multiple inside hosts can share one public address. For this active session, PC1 starts as 10.10.10.25:51514, but external devices see the packet as coming from 203.0.113.10:49172. The SaaS partner’s firewall must match the translated source tuple, not the private inside tuple.

• Private source tuple fails because 10.10.10.25:51514 is only visible before NAT on the inside network.
• Mixed port values fails because PAT changed the source port to 49172, not just the IP address.
• Outside server tuple fails because 198.51.100.50:443 identifies the destination service, not PC1’s translated source.

Question 4

Topic: Network Infrastructure and Connectivity

A network operations team moves a packet-capture helper from a Windows VM to a Docker container on a Linux server. The helper starts but cannot capture frames from a test VLAN.

Exhibit: Troubleshooting notes

Container host OS: Ubuntu Linux
Container network: can ping default gateway and switch SVI
Application requirement: Windows packet-capture driver
Log: driver load failed - unsupported kernel interface

Which root cause is best supported by the facts?

Options:

• A. The VM had weaker isolation than the container.

• B. The container depends on the host OS kernel.

• C. The container is missing Layer 3 connectivity.

• D. The switch trunk is pruning the test VLAN.

Best answer: B

Explanation: The core issue is the operating-system dependency of containers. A container packages an application and its user-space dependencies, but it shares the host operating system kernel. The exhibit shows the container can reach the gateway and switch SVI, so basic network connectivity is not the problem. The failure occurs when the application tries to load a Windows packet-capture driver on an Ubuntu Linux host, which is not supported by the shared-kernel container model.

A virtual machine would be different because it runs its own guest OS on virtual hardware, providing stronger OS isolation and support for OS-specific kernel components.

• Layer 3 connectivity is contradicted by successful pings to the gateway and switch SVI.
• VLAN pruning is not supported because the visible failure is a driver load error, not missing VLAN reachability.
• Isolation reversal is wrong because VMs generally provide stronger OS isolation than containers.

Question 5

Topic: AI, Network Operations and Management

A network team must apply the same approved syslog and NTP settings to 60 Cisco IOS XE access switches every quarter. The process must be repeatable from a management workstation, avoid per-device manual CLI sessions, and allow the same change to be rerun consistently. Which management decision best fits this goal?

Options:

• A. Enable SPAN sessions on all access ports

• B. Use a terminal emulator to paste commands manually

• C. Configure SNMP traps on each switch

• D. Use an Ansible inventory and playbook over SSH

Best answer: D

Explanation: Automation-based management is used when repeatable network operations are executed through scripts or automation tools instead of individual manual sessions. In this scenario, the team needs to apply the same approved settings to many IOS XE switches and rerun the process consistently. An Ansible inventory defines the target devices, and a playbook defines the tasks to execute, commonly using SSH to connect to network devices. This fits the requirement for repeatability and scale without requiring a controller-based management platform. Manual CLI access can work for one device, but it is not the best operational model for recurring changes across 60 switches.

• SNMP traps report events to a management system; they do not define and rerun configuration changes across devices.
• Manual command pasting can configure devices, but it does not meet the repeatability and scale requirements.
• SPAN sessions mirror traffic for analysis and do not manage device configuration.

Question 6

Topic: Network Infrastructure and Connectivity

A user reports intermittent slow printing through switch port FastEthernet0/12. The printer NIC was recently hard-set to 100 Mb/s full duplex, while the switch port is left at auto negotiation.

Exhibit:

SW1# show interfaces fastEthernet0/12
FastEthernet0/12 is up, line protocol is up
  Hardware is Fast Ethernet, address is 001b.2a10.120c
  MTU 1500 bytes, BW 100000 Kbit/sec
  Half-duplex, 100Mb/s, media type is 10/100BaseTX
  5 minute input rate 21000 bits/sec
  5 minute output rate 92000 bits/sec
  0 input errors, 0 CRC, 0 frame
  0 output errors, 1846 collisions, 327 late collision

What is the best interpretation of the evidence?

Options:

• A. The printer has an incorrect default gateway

• B. The link is blocked by spanning tree

• C. A duplex mismatch exists on the link

• D. The switchport is assigned to the wrong VLAN

Best answer: C

Explanation: The key evidence is the combination of half-duplex operation on the switch and increasing collisions, especially late collisions. In Ethernet, collisions are expected only on half-duplex links, but late collisions usually indicate a physical-layer or duplex problem rather than normal contention. The stem states that the printer was hard-set to 100 Mb/s full duplex while the switch auto-negotiated to 100 Mb/s half duplex, creating a duplex mismatch. The best next action would be to make both sides use the same duplex setting, preferably auto negotiation on both sides if supported. VLAN, gateway, and STP issues would affect reachability or forwarding state, not create collision counters on an active interface.

• Wrong VLAN could break connectivity, but it would not explain collisions or late collisions on the physical interface.
• Bad gateway affects off-subnet traffic, not Layer 1 or duplex counters on the switchport.
• STP blocking would prevent forwarding, but the exhibit shows an up interface with traffic and collision counters.

Question 7

Topic: AI, Network Operations and Management

A network administrator is reviewing why an NMS shows both periodic interface utilization graphs and immediate link-down alerts for R1.

Exhibit: Packet-capture summary

10:00:00 10.10.10.50:43122 -> 10.10.10.1:161  SNMP GetRequest ifInOctets.2
10:00:00 10.10.10.1:161   -> 10.10.10.50:43122 SNMP Response ifInOctets.2
10:05:17 10.10.10.1:162   -> 10.10.10.50:162   SNMP Trap linkDown Gi0/1

Which interpretation best matches the exhibit?

Options:

• A. The NMS polls the agent, and the agent sends notifications.

• B. R1 polls the NMS, and the NMS sends interface traps.

• C. SNMP uses only notifications, so polling is not shown.

• D. The traffic is syslog because it reports a link-down event.

Best answer: A

Explanation: SNMP monitoring uses a manager-agent model. The NMS is the SNMP manager, and the network device runs the SNMP agent. Polling occurs when the manager sends requests, such as GetRequest messages, to read values from the agent, commonly over UDP 161. Notifications are event-driven messages from the agent to the manager, such as traps or informs, commonly sent to UDP 162. In the exhibit, the utilization graph data comes from polling ifInOctets, while the immediate link-down alert comes from an SNMP trap sent by R1. The key distinction is scheduled manager queries versus event-driven agent notifications.

• Reversed roles fails because the request originates from the NMS, while the device returns the SNMP response.
• Notifications only fails because the exhibit clearly includes a GetRequest and Response before the trap.
• Syslog confusion fails because the packet summary identifies SNMP operations and ports, not syslog messages.

Question 8

Topic: Network Services and Security

Users in VLAN 20 report intermittent loss of connectivity. A packet capture shows DHCP offers arriving from an unauthorized device on access port Gi1/0/12. The legitimate DHCP server is reachable through uplink Gi1/0/48.

Exhibit:

SW1# show ip dhcp snooping
Switch DHCP snooping is disabled
DHCP snooping is configured on following VLANs: none

Interface        Trusted    Rate limit (pps)
Gi1/0/12         no         15
Gi1/0/48         no         unlimited

What is the best next action?

Options:

• A. Create an ACL blocking all UDP traffic from Gi1/0/48.

• B. Enable DHCP snooping for VLAN 20 and trust Gi1/0/48.

• C. Trust Gi1/0/12 to allow DHCP replies from that port.

• D. Configure port security on Gi1/0/12 with one MAC address.

Best answer: B

Explanation: DHCP snooping protects a VLAN from unauthorized DHCP servers by allowing DHCP server messages only on trusted interfaces. In the exhibit, DHCP snooping is disabled and no VLANs are configured, so the switch is not filtering rogue DHCP offers. The legitimate server is reached through Gi1/0/48, so that uplink should be trusted after enabling DHCP snooping for VLAN 20. Access ports such as Gi1/0/12 should remain untrusted so DHCP offers from a rogue server are dropped. The key is to trust the server-facing path, not the client-facing rogue port.

• Trusting the rogue port fails because it would allow unauthorized DHCP offers from Gi1/0/12.
• Port security limits MAC addresses but does not specifically block DHCP server messages.
• Blocking UDP on the uplink would disrupt legitimate DHCP traffic from the real server path.

Question 9

Topic: Network Services and Security

A site-to-site VPN between R1 and R2 no longer passes traffic between 10.10.10.0/24 and 10.20.20.0/24. R1 can ping R2’s public IP address, and the crypto ACL counters increase when users try to connect.

Exhibit: R1 evidence

IKE peer: 203.0.113.2  state: ESTABLISHED
IPsec SAs for peer: none
Last negotiation message: no matching IPsec proposal
R1 proposal: ESP-AES with SHA-HMAC
R2 proposal: AH-SHA-HMAC

Which corrective action is best supported by the evidence?

Options:

• A. Change the default route toward the LAN gateway.

• B. Configure matching ESP proposals on both peers.

• C. Replace the crypto ACL with a standard ACL.

• D. Add a DHCP relay on the inside interface.

Best answer: B

Explanation: IPsec VPN setup has two major parts: IKE negotiates security associations and keying material, while IPsec protocols protect the actual user traffic. The exhibit shows the peer is reachable and IKE is already established, so the failure is not basic IP connectivity or IKE peer discovery. The decisive clue is that no IPsec SAs exist and the last negotiation message reports no matching IPsec proposal. R1 proposes ESP, while R2 proposes AH, so they cannot agree on the traffic-protection protocol. Matching ESP parameters on both peers allows the VPN to create IPsec SAs and protect data traffic with encryption and integrity as configured. The ACL is generating interesting traffic, so replacing it with a standard ACL is not the supported fix.

• Standard ACL change fails because crypto ACLs define interesting traffic, and the counters already show matching traffic.
• DHCP relay is unrelated because the symptom is intersite VPN traffic, not client address assignment.
• Default route change is unsupported because the public peer is reachable and the negotiation reaches the IPsec proposal stage.

Question 10

Topic: AI, Network Operations and Management

A help desk reports that a conference-room wall jack stopped working after a small unmanaged switch was connected to it. The access switch shows the port is down and has these recent syslog entries:

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on PortFast enabled port Gi1/0/18, disabling port
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/18, putting Gi1/0/18 in err-disable state

Which event is reported by the syslog messages?

Options:

• A. The port failed 802.1Q trunk negotiation

• B. Storm control shut down the interface

• C. DHCP snooping blocked an untrusted offer

• D. BPDU Guard disabled the PortFast access port

Best answer: D

Explanation: Cisco syslog messages identify the reporting facility, severity, mnemonic, and text. Here, SPANTREE is the source facility, BLOCK_BPDUGUARD is the mnemonic, and the message text says a BPDU was received on a PortFast-enabled interface. The follow-up PM-4-ERR_DISABLE message confirms the port manager placed Gi1/0/18 into an err-disabled state because of BPDU Guard. This matches the symptom: the wall jack stopped working after another switch was connected. The key takeaway is to interpret the mnemonic and message text before assuming a cabling, DHCP, or VLAN issue.

• Trunk negotiation is not supported because the messages do not mention DTP, trunking, or VLAN tagging.
• Storm control is not supported because the mnemonic and text reference BPDU Guard, not broadcast or multicast thresholds.
• DHCP snooping is not supported because the messages do not mention DHCP packets, bindings, or an untrusted port.

Question 11

Topic: IP Routing

Users behind R1 report that they cannot reach server 10.20.30.10, but they can reach 10.20.30.200. R1 has a FULL OSPF neighbor relationship, its uplink is up, and R1 can ping 192.0.2.2 but not 192.0.2.6.

Exhibit: R1 route excerpt

O 10.20.30.0/24 [110/20] via 192.0.2.2, GigabitEthernet0/0
S 10.20.30.0/25 [1/0] via 192.0.2.6, GigabitEthernet0/0

What is the best corrective action?

Options:

• A. Reset the OSPF neighbor adjacency on R1.

• B. Correct or remove the static 10.20.30.0/25 route.

• C. Increase the OSPF metric for 10.20.30.0/24.

• D. Lower the OSPF administrative distance below 1.

Best answer: B

Explanation: Route selection uses the longest matching prefix before comparing administrative distance or metric. The destination 10.20.30.10 falls within 10.20.30.0/25, so R1 selects the static route with source code S and next hop 192.0.2.6. That next hop is not reachable from R1. The working host 10.20.30.200 is outside the /25, so it uses the OSPF-learned /24 through 192.0.2.2. The source code, prefix length, [AD/metric], and next-hop fields each describe different facts; here the decisive fact is the more specific prefix with a bad next hop.

• Changing OSPF AD does not help because longest prefix match selects the static /25 before AD is compared.
• Changing OSPF metric is irrelevant because the /24 route is not competing with the more specific /25 for 10.20.30.10.
• Resetting OSPF is unsupported because the OSPF adjacency is FULL and the OSPF route works for 10.20.30.200.

Question 12

Topic: Network Services and Security

An engineer reports that SSH login to R1 with centralized credentials fails, but a known local break-glass account succeeds. Based only on the exhibit, what is the best interpretation?

Exhibit:

R1# show running-config | section aaa|line vty|tacacs
aaa new-model
aaa authentication login VTY group tacacs+ local
aaa authorization exec VTY group tacacs+ local
tacacs server TAC1
 address ipv4 10.10.10.5
 key <redacted>
line vty 0 4
 login authentication VTY
 authorization exec VTY
 transport input ssh

R1# show aaa servers
TACACS+ server 10.10.10.5: state DEAD, timeouts 8

Options:

• A. R1 tries TACACS+ first, then local fallback.

• B. R1 uses only the local database for VTY access.

• C. R1 is authenticating VTY users with RADIUS.

• D. TACACS+ authenticated the user but denied exec access.

Best answer: A

Explanation: AAA method lists are evaluated in order. The VTY lines reference the VTY login and exec authorization method lists, and those lists specify group tacacs+ local. That means R1 attempts TACACS+ first for management access. If the TACACS+ server cannot be used, the device can fall back to the local username database. The show aaa servers output shows the TACACS+ server in a dead state with timeouts, which explains why centralized credentials fail while a local break-glass account succeeds. This is not RADIUS behavior, and it is not evidence that TACACS+ accepted the user and denied exec authorization.

• RADIUS claim fails because the configuration names tacacs+, not a RADIUS server group.
• Local-only claim fails because the method list attempts the TACACS+ group before local.
• Exec denial claim fails because the server is unreachable; the exhibit does not show a successful TACACS+ authentication followed by authorization failure.

Question 13

Topic: IP Routing

R1 should send traffic only to server 172.16.50.10 through next hop 10.0.12.2. All other 172.16.50.0/24 destinations should use the OSPF-learned path through 10.0.13.3. After a change, users report that several hosts in 172.16.50.0/24 are taking the wrong path.

Exhibit:

R1# show ip interface brief | include 10.0.1
Gi0/1     10.0.12.1     YES manual up up
Gi0/2     10.0.13.1     YES manual up up

R1# show running-config | include ^ip route
ip route 172.16.50.0 255.255.255.0 10.0.12.2

R1# show ip route 172.16.50.25
Routing entry for 172.16.50.0/24
  Known via "static", distance 1, metric 0
  * 10.0.12.2

What is the best corrective action?

Options:

• A. Configure a default route through 10.0.13.3

• B. Replace the static route with a /32 host route

• C. Increase the static route administrative distance above OSPF

• D. Shut and re-enable Gi0/1 toward 10.0.12.2

Best answer: B

Explanation: The problem is the static route mask. The configured route is 172.16.50.0/24, so any destination in that subnet, including 172.16.50.25, matches the static route and uses next hop 10.0.12.2. Because static routes have a lower administrative distance than OSPF by default, the OSPF route for the same /24 is not used for those destinations. To steer only one server, remove the /24 static route and configure a host route such as ip route 172.16.50.10 255.255.255.255 10.0.12.2. Longest-prefix match will then use the /32 only for that server, while other hosts use the OSPF route.

• Raising AD would make OSPF win for the whole /24, but it would not preserve the special path for only 172.16.50.10.
• Interface cycling is unsupported because both relevant interfaces are already up/up.
• Default routing does not fix the overly broad static route because the /24 route is a more specific match.

Question 14

Topic: AI, Network Operations and Management

An access point connected to SW1 lost connectivity at 10:14. The syslog collector immediately received these messages, but the SNMP-based NMS dashboard did not show the port down until its 10:19 poll.

10:14:07 %LINK-3-UPDOWN: Interface Gi1/0/24, changed state to down
10:14:08 %LINEPROTO-5-UPDOWN: Line protocol on Gi1/0/24, changed state to down
NMS polling interval: 5 minutes

Which action best addresses the operations requirement for the NMS to receive link-down events without waiting for the next poll?

Options:

• A. Change the AP access port to an 802.1Q trunk

• B. Enable SNMP link-status traps or informs to the NMS

• C. Add an SNMP read-only community string only

• D. Increase the syslog severity level to debugging

Best answer: B

Explanation: SNMP and syslog serve different network operations roles. Syslog reports device-generated messages, such as link and line protocol state changes, to a syslog collector as events occur. SNMP polling lets an NMS periodically query device objects, so the NMS may not notice a link change until the next polling cycle. To make an SNMP-based NMS learn about link-down events promptly, configure the device to send SNMP traps or informs for relevant events to that NMS. A read-only community supports polling, but it does not by itself create event-driven notifications.

• Debug syslog does not make the SNMP-based NMS receive events; syslog is already receiving the link messages.
• Trunk change is unsupported because the symptom is monitoring delay, not VLAN tagging.
• Read-only polling allows SNMP queries but still depends on the NMS poll interval.

Question 15

Topic: Network Infrastructure and Connectivity

A PC connected to access VLAN 20 on an IOS XE Layer 3 switch fails to obtain a DHCPv4 address from the centralized server at 10.10.50.10. The VLAN 20 default gateway is interface Vlan20 with address 10.10.20.1/24. Routing between VLAN 20 and the server subnet is working, and no ACL blocks DHCP. The switch must not lease addresses locally. Which configuration decision should be made?

Options:

• A. Configure ip address dhcp under interface Vlan20.

• B. Create a local DHCP pool for 10.10.20.0/24 on the switch.

• C. Configure ip helper-address 10.10.50.10 under the server-facing interface.

• D. Configure ip helper-address 10.10.50.10 under interface Vlan20.

Best answer: D

Explanation: A DHCPv4 client initially sends broadcasts because it does not yet have a usable IPv4 address or know the server’s location. When the DHCP server is on a different subnet, the router or Layer 3 switch interface that receives those client broadcasts must act as the DHCP relay. On Cisco IOS XE, that means placing ip helper-address on the client VLAN SVI, not on the server-facing interface. The helper converts the client broadcast into a unicast message toward the configured DHCP server address. Since routing and ACLs are already working and the switch should not provide leases locally, the missing configuration is relay on interface Vlan20.

• Server-facing helper fails because that interface does not receive the client’s initial DHCP broadcast.
• SVI as DHCP client fails because ip address dhcp makes the SVI request its own address.
• Local DHCP pool fails because the requirement is to use the centralized expected server, not the switch.

Question 16

Topic: Switching and Network Access

A technician is checking Rapid PVST+ behavior on switch SW2 for VLAN 20. Based only on the output, which interpretation is correct?

Exhibit:

SW2# show spanning-tree vlan 20

VLAN0020
  Root ID    Priority    24596
             Address     001b.0caa.1000
             Cost        19
             Port        1 (GigabitEthernet0/1)

Interface        Role Sts Cost      Prio.Nbr Type
---------------- ---- --- --------- -------- ----------------
Gi0/1            Root FWD 19        128.1    P2p
Gi0/2            Desg FWD 19        128.2    P2p
Gi0/3            Altn BLK 19        128.3    P2p
Gi0/4            Desg FWD 19        128.4    Edge P2p

Options:

• A. Gi0/1 is SW2’s best path toward the root bridge.

• B. Gi0/4 is SW2’s root port because it is an edge port.

• C. Gi0/3 is forwarding as the segment’s designated port.

• D. Gi0/2 is blocking as SW2’s alternate path.

Best answer: A

Explanation: In Rapid PVST+, each non-root switch has one root port per VLAN: the forwarding port with the best path to the root bridge. The output explicitly lists Gi0/1 as Root FWD, so it is SW2’s root port for VLAN 20. Designated ports forward for their attached segment, as shown by Desg FWD on Gi0/2 and Gi0/4. An alternate port is a backup path that is currently discarding/blocking, shown here as Altn BLK on Gi0/3.

The port role and state columns are the decisive evidence; the edge indication on Gi0/4 does not make it a root port.

• Gi0/2 alternate fails because the role column shows Desg, not Altn.
• Gi0/3 designated fails because the output shows Altn BLK, meaning a backup path that is not forwarding.
• Gi0/4 root fails because Edge P2p describes the port type, while the role column shows Desg.

Question 17

Topic: Switching and Network Access

A Layer 3 switch, DSW1, connects Gi1/0/24 directly to router R1 Gi0/0. The design requires a routed point-to-point link using 10.10.10.0/30, with DSW1 as 10.10.10.2 and R1 as 10.10.10.1. DSW1 cannot establish routed connectivity to R1.

Exhibit:

DSW1# show interfaces gi1/0/24 switchport
Switchport: Enabled
Administrative Mode: static access
Operational Mode: static access

DSW1# show ip interface brief | include Gi1/0/24
GigabitEthernet1/0/24  unassigned  YES unset  up  up

DSW1(config-if)# ip address 10.10.10.2 255.255.255.252
% IP addresses may not be configured on L2 links.

Which corrective action best matches the required design?

Options:

• A. Enter no switchport, then assign 10.10.10.2/30.

• B. Configure Gi1/0/24 as an 802.1Q trunk.

• C. Set the switch default gateway to 10.10.10.1.

• D. Create an SVI with 10.10.10.2/30.

Best answer: A

Explanation: On a multilayer switch, a physical interface operates as a Layer 2 switchport by default on many platforms. The exhibit shows Switchport: Enabled, no IP address on Gi1/0/24, and an IOS message stating that IP addresses cannot be configured on Layer 2 links. For switch-to-router connectivity that requires a routed point-to-point link, the switch interface must be changed to a Layer 3 routed port with no switchport, then assigned the required IP address and mask. An SVI would provide Layer 3 connectivity for a VLAN, but it does not match the stated requirement for a routed physical interface.

• SVI workaround fails because the design calls for IP addressing on the physical switch-to-router link, not a VLAN interface.
• Trunking fails because an 802.1Q trunk is still Layer 2 behavior and does not make the physical port routed.
• Default gateway fails because it is used for Layer 2 switch management, not for enabling routed-port connectivity.

Question 18

Topic: Network Infrastructure and Connectivity

PC1 in VLAN 20 cannot reach an IPv6 application server in another subnet. A neighboring PC in VLAN 20 can reach the server. Review the exhibit and choose the best next action.

PC1 Ethernet status: connected
PC1 IPv6 address: 2001:db8:10:20::25/64
PC1 default gateway: 2001:db8:10:21::1
PC1 ping 2001:db8:10:20::1: success
PC1 ping 2001:db8:10:50::10: fails

R1 Gi0/0.20 status: up/up
R1 Gi0/0.20 IPv6: 2001:db8:10:20::1/64
R1 Gi0/0.20 link-local: FE80::1

Options:

• A. Troubleshoot the R1 Gi0/0.20 interface state

• B. Change PC1 prefix length to /128

• C. Change PC1 default gateway to 2001:db8:10:20::1

• D. Change PC1 IPv6 address to 2001:db8:10:21::25/64

Best answer: C

Explanation: For an IPv6 host to reach another subnet, the host needs a valid local IPv6 address and an on-link default gateway. PC1 is connected, uses the correct VLAN 20 prefix 2001:db8:10:20::/64, and can ping R1’s VLAN 20 address, so the local interface and prefix are working. The configured gateway 2001:db8:10:21::1 belongs to a different /64 and is not the router address shown for VLAN 20. Setting the gateway to R1’s VLAN 20 address fixes the off-subnet forwarding problem. A link-local gateway such as FE80::1 could also be valid if configured with the proper interface scope, but the listed best action uses the visible global address.

• Wrong prefix move fails because PC1 already matches the VLAN 20 /64 and can reach the router’s VLAN 20 address.
• /128 host prefix fails because it would remove the normal on-link /64 behavior needed on the LAN.
• Interface-state troubleshooting is premature because R1 Gi0/0.20 is up/up and responds to PC1.

Question 19

Topic: Network Services and Security

An administrator can log in to R1 from the console with the local username netops, but SSH login to R1 with the same username fails immediately. What is the best corrective action supported by the evidence?

Exhibit:

R1# show running-config | include aaa|username|tacacs|login authentication|transport input
aaa new-model
username netops secret <hidden>
aaa authentication login default group tacacs+ local
tacacs server ISE1
 address ipv4 10.50.5.10
 login authentication default
 transport input ssh

R1# ping 10.50.5.10
!!!!!

TACACS+ server log: user=netops result=REJECT reason=unknown user

Options:

• A. Fix routing to the TACACS+ server address.

• B. Remove aaa new-model so the local username is used.

• C. Add transport input ssh under the VTY lines.

• D. Create or authorize netops on the TACACS+ server.

Best answer: D

Explanation: With aaa authentication login default group tacacs+ local, IOS tries TACACS+ first and uses the local database only if the TACACS+ method is unavailable or returns an error condition. Here, the server is reachable because the ping succeeds, and the TACACS+ log shows an explicit REJECT for netops as an unknown user. That is a valid authentication failure from the AAA server, not a reachability failure. The practical fix is to create or authorize the account on the TACACS+ server, or use a TACACS+ account that is already permitted. Local console success does not prove SSH will use the local database when the remote AAA server actively rejects the login.

• Disabling AAA is unnecessary and would remove the configured centralized authentication behavior.
• Adding SSH transport does not help because transport input ssh is already present.
• Fixing routing is not supported because R1 can ping the TACACS+ server and the server logs the login attempt.

Question 20

Topic: Switching and Network Access

A campus access switch has user-facing ports in VLAN 20. The team wants hosts to connect without the normal STP listening/learning delay, but any port that receives a BPDU from an accidentally connected switch must be disabled to protect the Layer 2 topology. Uplinks must not be affected. Which configuration decision is safest?

Options:

• A. Configure Loop Guard on the access ports.

• B. Configure Root Guard on the access ports.

• C. Configure PortFast and BPDU Guard on the access ports.

• D. Configure only PortFast on the access ports.

Best answer: C

Explanation: Rapid PVST+ edge ports that connect only to end hosts commonly use PortFast so the port can move to forwarding quickly. Because PortFast can be dangerous if someone connects a switch, BPDU Guard is the safer companion feature: if a BPDU arrives on that edge port, the switch places the port into an err-disabled state. Applying this only to user-facing access ports preserves normal STP operation on uplinks. Root Guard and Loop Guard protect different STP failure cases and do not match the requirement to disable any edge port that receives a BPDU.

• PortFast only meets the speed goal but does not disable the port when a BPDU is received.
• Root Guard blocks ports that receive superior BPDUs, but it is not the standard edge-port protection for any BPDU.
• Loop Guard protects against unidirectional failures that stop BPDUs, not accidental switch attachment on host ports.

Question 21

Topic: IP Routing

A router must forward a packet with destination IPv4 address 10.20.30.130. Use the routing table excerpt to determine the best forwarding match.

Exhibit: show ip route excerpt

Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 203.0.113.1
O  10.20.0.0/16 [110/20] via 192.0.2.1, GigabitEthernet0/0
O  10.20.30.0/24 [110/30] via 192.0.2.5, GigabitEthernet0/1
S  10.20.30.128/25 [1/0] via 192.0.2.9, GigabitEthernet0/2
O  10.20.31.0/24 [110/25] via 192.0.2.13, GigabitEthernet0/3

Which routing table entry will the router use?

Options:

• A. 10.20.0.0/16 via 192.0.2.1

• B. 0.0.0.0/0 via 203.0.113.1

• C. 10.20.30.128/25 via 192.0.2.9

• D. 10.20.30.0/24 via 192.0.2.5

Best answer: C

Explanation: Routers choose a forwarding entry by longest prefix match, meaning the matching route with the most prefix bits is preferred. The address 10.20.30.130 matches several entries: the default route, 10.20.0.0/16, 10.20.30.0/24, and 10.20.30.128/25. The /25 route covers addresses 10.20.30.128 through 10.20.30.255, so it includes the destination and is more specific than the /24 and /16 routes. Administrative distance and metric are used only after the router compares routes to the same prefix length for the same destination match.

• Broader /24 match fails because 10.20.30.0/24 matches the destination but is less specific than the /25 route.
• Broader /16 match fails because 10.20.0.0/16 covers many more addresses and loses to longer matching prefixes.
• Default route fails because it is used only when no more specific matching route exists.

Question 22

Topic: IP Routing

An administrator is testing traffic from R1’s LAN (10.10.10.0/24) to a server at 10.30.30.10. A junior technician concludes that R1’s static route is missing. What is the best interpretation of the evidence?

Exhibit: R1 evidence

R1# show ip route 10.30.30.10
Routing entry for 10.30.30.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 192.168.12.2

R1# ping 192.168.12.2
!!!!!
R1# ping 10.30.30.10 source 10.10.10.1
.....

Options:

• A. R1 is missing a route to 10.30.30.0/24.

• B. R1 must lower the static route administrative distance.

• C. R1 cannot reach its configured next-hop address.

• D. R1 has a valid static route; check downstream or return routing.

Best answer: D

Explanation: The routing table shows that R1 has an installed static route for 10.30.30.0/24 through next hop 192.168.12.2. The successful ping to 192.168.12.2 confirms that R1 can reach the next hop for that static route. Because the sourced ping to 10.30.30.10 fails, the evidence does not support the conclusion that R1 is missing the static route. The next troubleshooting step is to verify forwarding beyond the next hop and confirm the remote network has a return route to 10.10.10.0/24.

• Missing route fails because show ip route displays an installed static route for the destination prefix.
• Administrative distance is not the issue because the static route is already selected and installed.
• Next-hop failure is contradicted by the successful ping to 192.168.12.2.

Question 23

Topic: AI, Network Operations and Management

Users in VLAN 20 report intermittent access to an internal application. An engineer wants to use an agentic AI network assistant during triage.

Exhibit: Collected clues

SW1: Gi1/0/24 trunk to SW2 changed state up/down 6 times in 10 minutes
SW1: %SPANTREE-2-TOPO_CHG: VLAN0020 topology change on Gi1/0/24
R1: OSPF neighbor to core is FULL; default route is present
DHCP: VLAN 20 leases are being issued successfully

Which action is the most suitable use of agentic AI at this stage?

Options:

• A. Declare the application server as the root cause

• B. Summarize the evidence and recommend validation commands

• C. Automatically change the OSPF cost toward the core

• D. Rebuild the VLAN 20 DHCP scope

Best answer: B

Explanation: Agentic AI is useful in network operations when it helps triage evidence, summarize logs, and guide the next investigation steps. In this case, the visible clues point more toward a Layer 2 instability on the trunk carrying VLAN 20 than toward routing or DHCP. A suitable AI-assisted workflow would ask the assistant to summarize the symptoms and propose validation commands such as checking interface counters, trunk status, STP state, and neighbor information. The engineer should still verify the recommendation with device output before changing the network.

The key takeaway is that agentic AI can accelerate investigation, but it should not replace evidence-based validation or make unsupported changes.

• OSPF change is not supported because the neighbor is FULL and the default route is present.
• DHCP rebuild is not supported because leases are being issued successfully.
• Application root cause is premature because the shown evidence highlights trunk flaps and STP changes.

Question 24

Topic: Network Infrastructure and Connectivity

A warehouse IP camera connected to switch port Gi1/0/18 repeatedly loses connectivity. The same camera works normally when connected with a 3-meter patch cable at the switch. The installed horizontal cable run to the camera is documented as 145 meters of Cat6. The port shows up/up, autonegotiated 1000/full, increasing CRC/input errors, and intermittent DHCP renewals.

What is the best corrective action?

Options:

• A. Configure a static IP address on the camera

• B. Force the switch port to 1000/full duplex

• C. Shorten the copper run or add an intermediate device

• D. Change the access VLAN on Gi1/0/18

Best answer: C

Explanation: Twisted-pair Ethernet links such as 1000BASE-T are designed for a maximum channel length of about 100 meters. A 145-meter Cat6 run can still show up/up, but the signal margin may be poor enough to create CRC/input errors, link instability, and intermittent upper-layer symptoms such as DHCP renewal failures. Because the camera works with a short patch cable at the same switch, the endpoint and switchport configuration are less likely to be the root problem.

The durable fix is to bring the copper segment within supported distance, place an intermediate switch/extender where appropriate, or use fiber for the longer run.

• VLAN change is not supported because the same device works at the switch and the main clue is physical-layer errors.
• Static IP may mask DHCP symptoms but does not fix CRC/input errors caused by signal degradation.
• Forced duplex is not indicated because the port already negotiated 1000/full, and forcing settings can create new negotiation issues.

Question 25

Topic: AI, Network Operations and Management

A network operations dashboard receives these syslog messages from switch SW1. The team wants to categorize and prioritize the event based on syslog facility and severity. What is the best interpretation?

May 25 10:14:07.112: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/12, changed state to down
May 25 10:14:07.118: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/12, changed state to down

Options:

• A. Treat it as a LINEPROTO facility critical event.

• B. Deprioritize it because severity 3 is lower than severity 5.

• C. Prioritize it as a LINK facility error for Gi1/0/12.

• D. Categorize it as informational because UPDOWN is routine.

Best answer: C

Explanation: Cisco syslog messages commonly use the format %FACILITY-SEVERITY-MNEMONIC. The facility categorizes the source or subsystem, and the severity number indicates urgency. Lower severity numbers are more urgent: 0 is emergency, 3 is error, 5 is notification, and 7 is debugging. In the exhibit, %LINK-3-UPDOWN shows a physical link-related facility with severity 3, so it should be prioritized above the %LINEPROTO-5-UPDOWN notification message for the same interface. The key takeaway is to read both the facility and the numeric severity, not just the mnemonic text.

• Critical confusion fails because severity 5 is notification, not critical.
• Mnemonic-only reading fails because UPDOWN does not override the numeric severity.
• Number order reversal fails because lower syslog severity numbers indicate higher urgency.

Questions 26-50

Question 26

Topic: Network Services and Security

A company can send email, but external senders receive delivery failures when sending to example.com. The public firewall permits inbound SMTP only to the mail server at 198.51.100.25.

Exhibit: Public DNS lookup

$ nslookup -type=mx example.com
example.com    MX preference = 10, mail exchanger = web.example.com

$ nslookup web.example.com
Name: web.example.com
Address: 198.51.100.20

$ nslookup mail.example.com
Name: mail.example.com
Address: 198.51.100.25

What is the best next action?

Options:

• A. Change the MX record to mail.example.com.

• B. Change user email clients to use web.example.com.

• C. Change the A record for web.example.com to 198.51.100.25.

• D. Add a PTR record for 198.51.100.25.

Best answer: A

Explanation: An MX record tells other mail systems which host accepts email for a domain. In the exhibit, example.com publishes web.example.com as its mail exchanger, but that host resolves to 198.51.100.20. The firewall permits inbound SMTP only to 198.51.100.25, and mail.example.com already resolves to that address. Updating the MX record to mail.example.com directs external mail servers to the reachable mail host. Changing the web server A record would break or misdirect web service instead of fixing the mail-routing record.

• Web A record change misuses the web hostname to fix mail and can disrupt the web service.
• PTR record can help reverse DNS checks, but it does not tell senders where to deliver mail for the domain.
• Client setting change affects outbound client submission, not inbound delivery from external mail servers.

Question 27

Topic: Network Infrastructure and Connectivity

A user reports that a laptop can see the corporate SSID but cannot join it. Other users on the same floor are connected. Review the wireless client event summary.

Exhibit:

Client MAC: 8c:7b:9d:xx:xx:xx
SSID: CorpWiFi
RSSI: -48 dBm
SNR: 34 dB
Channel: 6
Event: Association successful
Event: WPA2 4-way handshake failed
Reason: PSK mismatch or unsupported cipher

What is the best interpretation?

Options:

• A. The laptop is too far from the AP

• B. The AP is using an overlapping channel

• C. The client failed to obtain a DHCP address

• D. Wireless security settings do not match

Best answer: D

Explanation: The key distinction is where the connection process fails. The exhibit shows good signal quality with RSSI of -48 dBm and SNR of 34 dB, and the client successfully associates to the SSID. That makes weak signal and channel selection less likely as the primary cause. The failure occurs during the WPA2 4-way handshake, with a reason that mentions a PSK mismatch or unsupported cipher. That points to a wireless authentication or encryption setting mismatch, such as the wrong passphrase, wrong WPA mode, or incompatible cipher configuration. DHCP happens after the client has completed Layer 2 wireless authentication, so it is not the best fit for this evidence.

• Weak signal is unlikely because the reported RSSI and SNR are strong enough for basic connectivity.
• Channel overlap could affect performance, but it does not best explain a WPA2 4-way handshake failure.
• DHCP failure would occur after successful wireless authentication, not during the WPA2 handshake.

Question 28

Topic: Network Services and Security

A network team must back up IOS XE switch configurations to a central management server across a shared management network. The security policy requires both user credentials and file contents to be encrypted in transit. Which file transfer choice should be configured?

Options:

• A. Use TFTP with a server ACL

• B. Use SCP over SSH

• C. Use FTP with a username and password

• D. Use plain HTTP file transfer

Best answer: B

Explanation: Secure device file transfer should protect both credentials and the configuration file contents while they cross the network. SCP and SFTP meet that requirement because they run over SSH and encrypt the session. FTP uses usernames and passwords but does not encrypt them or the transferred file by default. TFTP is simpler but provides no built-in authentication or encryption. Restricting a server with an ACL can limit who connects, but it does not encrypt the file transfer itself. For IOS XE management operations, choose an SSH-based file transfer method when confidentiality is required.

• FTP credentials fail because standard FTP sends credentials and data without encryption.
• TFTP with ACL limits access but still does not encrypt the configuration file.
• Plain HTTP does not provide encrypted transport unless HTTPS is used.

Question 29

Topic: IP Routing

A network engineer is checking OSPFv2 neighbors from router R1 on a shared Ethernet VLAN. Based only on the output, what is the best interpretation of the DR/BDR election?

Exhibit:

R1# show ip ospf neighbor

Neighbor ID     Pri   State           Dead Time   Address       Interface
2.2.2.2           1   FULL/DR         00:00:34    10.10.10.2    Gi0/0
3.3.3.3           1   FULL/BDR        00:00:38    10.10.10.3    Gi0/0
4.4.4.4           1   2WAY/DROTHER    00:00:31    10.10.10.4    Gi0/0

Options:

• A. R4 has an adjacency problem that requires a reset.

• B. R2 is DR and R3 is BDR on the segment.

• C. R1 is DR because it has FULL adjacencies.

• D. The DR election is incomplete because R4 is 2WAY.

Best answer: B

Explanation: On an OSPF broadcast network, routers elect a designated router (DR) and backup designated router (BDR). The State field in show ip ospf neighbor shows the neighbor relationship state and the neighbor’s role after the slash. FULL/DR means that neighbor is the DR, and FULL/BDR means that neighbor is the BDR. A 2WAY/DROTHER state with another non-DR router can be normal because DROTHER routers do not form full adjacencies with every other DROTHER. The key point is to interpret the role shown for the neighbor, not assume it is the local router’s role.

• Local-role assumption fails because FULL/DR describes the neighbor shown in that row, not R1.
• Resetting R4 is unnecessary from this evidence because 2WAY with a DROTHER can be expected on a broadcast segment.
• Incomplete election is not indicated because the output already identifies both a DR and a BDR.

Question 30

Topic: IP Routing

A user connected to SW1 Gi1/0/12 cannot reach the default gateway or any remote subnet. Other VLAN 20 users are working. The goal is to restore this user’s connectivity without changing the FHRP design.

Exhibit:

Client IP: 10.20.20.55/24
Client default gateway: 10.20.20.1

R1# show standby brief
Interface  Grp  Pri  State   Active    Standby    Virtual IP
Vl20       20   110  Active  local     10.20.20.3 10.20.20.1

R2# show standby brief
Interface  Grp  Pri  State   Active    Standby    Virtual IP
Vl20       20   100  Standby 10.20.20.2 local     10.20.20.1

SW1# show interfaces gi1/0/12 switchport
Operational Mode: static access
Access Mode VLAN: 30

Which configuration decision is most appropriate?

Options:

• A. Move Gi1/0/12 to access VLAN 20.

• B. Configure a floating static route on R2.

• C. Change the client default gateway to 10.20.20.2.

• D. Increase R1 HSRP priority for VLAN 20.

Best answer: A

Explanation: The visible HSRP state is healthy: R1 is Active, R2 is Standby, and both reference the same virtual IP address, 10.20.20.1. Since other VLAN 20 users are working, the FHRP gateway is less likely to be the fault. The affected client has a VLAN 20 IP address and gateway, but its access port is placed in VLAN 30, so its Layer 2 attachment does not match its IP subnet. The best fix is to place the access port in the VLAN that matches the client’s addressing plan. Changing HSRP priority or routing would not fix a host connected to the wrong VLAN.

• HSRP priority is not the issue because the active and standby roles are already established correctly.
• Physical gateway address is inappropriate because clients should use the virtual IP, not R1’s interface IP.
• Floating static route does not address the local Layer 2 VLAN mismatch on the client’s switchport.

Question 31

Topic: Network Infrastructure and Connectivity

R1 is the DHCPv4 server for VLAN 20. Clients receive addresses such as 192.168.20.55/24, but their default gateway is 192.168.10.1, so they cannot reach other networks. The VLAN 20 gateway is 192.168.20.1.

Exhibit: R1 DHCP configuration

ip dhcp excluded-address 192.168.20.1 192.168.20.20
!
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.10.1
 lease 7

Which configuration decision best fixes the issue for new DHCP leases?

Options:

• A. Shorten the DHCP lease from 7 days to 1 day.

• B. Remove the excluded address range for VLAN 20.

• C. Change the pool default-router to 192.168.20.1.

• D. Change the pool network to 192.168.10.0 255.255.255.0.

Best answer: C

Explanation: In an IOS XE DHCPv4 pool, the network statement defines the address range to lease, while default-router defines the gateway option sent to clients. Here, clients are already receiving valid 192.168.20.0/24 addresses, so the pool scope is not the problem. The incorrect value is the configured default gateway, which points to 192.168.10.1 instead of the VLAN 20 gateway, 192.168.20.1.

Exclusions prevent the server from leasing reserved addresses, and lease duration controls how long a client may keep an address. Neither changes the gateway option being delivered to clients.

• Wrong scope would move clients into 192.168.10.0/24, which conflicts with the stated VLAN 20 subnet.
• Removing exclusions does not correct the gateway option and could expose addresses reserved for other infrastructure devices to leasing. IOS automatically excludes addresses configured on the DHCP server’s own interfaces.
• Changing lease time affects renewal timing, not the default gateway option in the DHCP offer.

Question 32

Topic: Switching and Network Access

VLAN 20 users on access switch SW2 cannot reach their default gateway after an uplink change. The recorded topology says SW2 Gi1/0/48 connects to DIST1 Gi1/0/3 and carries VLANs 10, 20, and 30.

Exhibit:

SW2# show cdp neighbors interface gi1/0/48
Device ID  Local Intrfce  Capability  Port ID
DIST2      Gi1/0/48       S I         Gi1/0/7

SW2# show interfaces trunk
Port       Status     Native vlan  Vlans allowed
Gi1/0/48   trunking   1            10,20,30

DIST2# show interfaces trunk
Port       Status     Native vlan  Vlans allowed
Gi1/0/7    trunking   1            10,30

Which root cause is best supported by the evidence?

Options:

• A. DIST1 has an OSPF adjacency failure with SW2.

• B. The topology record is stale; SW2 uplinks to DIST2, where VLAN 20 is missing.

• C. SW2 Gi1/0/48 is configured as an access port in VLAN 20.

• D. CDP is disabled, so the physical neighbor cannot be validated.

Best answer: B

Explanation: CDP/LLDP neighbor output is useful for validating whether documentation matches the live cabling and switchport relationships. Here, the documentation says SW2 connects to DIST1, but the live CDP evidence shows SW2 Gi1/0/48 connects to DIST2 Gi1/0/7. The VLAN symptom also matches the actual path: SW2 allows VLAN 20 on its trunk, but DIST2 does not allow VLAN 20 on the connected trunk. The stale topology record could cause an engineer to troubleshoot the wrong distribution switch or apply the VLAN fix in the wrong place. The key validation step is to trust the current neighbor evidence over the recorded topology, then correct the actual trunk or update the documentation.

• Access-port assumption fails because show interfaces trunk shows SW2 Gi1/0/48 is actively trunking.
• CDP disabled fails because the CDP neighbor output is present and identifies the connected device.
• OSPF focus is unsupported because the evidence is Layer 2 neighbor and trunk VLAN information, not a routing adjacency problem.

Question 33

Topic: Network Infrastructure and Connectivity

A user on VLAN 20 can reach IPv4 sites but cannot reach any IPv6 site. The switch port to the PC is up and learning the PC MAC address in VLAN 20. DNS lookup for app.example.com returns AAAA 2001:db8:50::20.

Exhibit: IPv6 details

PC IPv6 address:        2001:db8:20:5::34/64
PC default gateway:     fe80::1
Router VLAN 20 SVI:     2001:db8:20:6::1/64, fe80::1
SVI state:              up/up

Which root cause is best supported by the evidence?

Options:

• A. The DNS AAAA record is missing.

• B. The PC uses the wrong IPv6 prefix for VLAN 20.

• C. The access port is assigned to the wrong VLAN.

• D. The router SVI is administratively down.

Best answer: B

Explanation: The evidence points to an IPv6 addressing problem, not Layer 2 or DNS. The switch port is up and learning the PC MAC address in VLAN 20, so the visible Layer 2 evidence is healthy. DNS is also resolving the name to an IPv6 AAAA record. The mismatch is between the host prefix and the router SVI prefix: the PC is configured in 2001:db8:20:5::/64, but VLAN 20’s router interface is in 2001:db8:20:6::/64. For normal host connectivity on a VLAN, the host IPv6 address should be in the same on-link prefix advertised or configured for that segment. The best fix is to correct the PC IPv6 addressing for VLAN 20.

• Wrong VLAN is not supported because the port is up and learning the PC MAC address in VLAN 20.
• Missing AAAA record is not supported because DNS returns an IPv6 address for the hostname.
• Down SVI is contradicted by the SVI state showing up/up.

Question 34

Topic: Switching and Network Access

A network technician is validating switch documentation before replacing a third-party edge firewall. The documentation says FW-EDGE is connected to SW1 Gi1/0/24.

Exhibit:

SW1# show lldp neighbors
Device ID    Local Intf    Hold-time    Capability    Port ID
FW-EDGE      Gi1/0/23      120          R             ge-0/0/1
AP-17        Gi1/0/24      120          B,W           eth0

Which interpretation is best supported by the LLDP evidence?

Options:

• A. CDP must be enabled before validating this multi-vendor link.

• B. The documentation does not match the current cabling.

• C. The firewall is unreachable because LLDP reports only Layer 2 neighbors.

• D. The documentation is correct because ge-0/0/1 is the firewall port.

Best answer: B

Explanation: LLDP is a standards-based neighbor discovery protocol that is useful for validating multi-vendor physical connectivity. In this output, Local Intf is the interface on SW1, while Device ID and Port ID describe the neighboring device and its interface. The exhibit shows FW-EDGE learned on SW1 Gi1/0/23, not Gi1/0/24. It also shows AP-17 on Gi1/0/24, so the documented firewall connection is inconsistent with the observed neighbor evidence. The next operational step would be to correct or investigate the cabling documentation before making the firewall change.

• Remote port confusion fails because ge-0/0/1 is the neighbor’s port, not the local switch interface.
• Reachability assumption fails because LLDP validates adjacency information, not end-to-end IP reachability.
• CDP requirement fails because LLDP is the appropriate standards-based protocol for multi-vendor neighbor discovery.

Question 35

Topic: Network Services and Security

A network engineer must create an IPv4 ACL on an IOS XE router to identify the policy as WEB-FILTER in the running configuration. The ACL must match TCP traffic from 10.10.20.0/24 to a specific web server on destination port 443. Which ACL configuration approach best meets these requirements?

Options:

• A. Create a named standard IPv4 ACL

• B. Create a numbered standard IPv4 ACL

• C. Create a numbered extended IPv4 ACL

• D. Create a named extended IPv4 ACL

Best answer: D

Explanation: IPv4 ACLs can be either numbered or named, and either standard or extended. The descriptive label requirement points to a named ACL, while the need to match TCP traffic to a specific destination port points to an extended ACL. Standard ACLs match only the source IPv4 address, so they cannot directly match the destination server or TCP port. A numbered extended ACL could match the traffic characteristics, but it would not satisfy the requirement to identify the policy as WEB-FILTER in the configuration. The key distinction is that naming and matching scope are separate ACL design choices.

• Numbered standard fails because standard ACLs match only source IPv4 addresses and use numeric identifiers.
• Named standard satisfies the descriptive-name requirement but cannot match destination address or TCP port.
• Numbered extended can match protocol and port, but it does not meet the named-policy constraint.

Question 36

Topic: Switching and Network Access

An access switch port for a user workstation stopped forwarding after a small unmanaged switch was connected at the desk. Review the log excerpt.

%SPANTREE-2-BLOCK_BPDUGUARD: Received BPDU on Gi1/0/10 with BPDU Guard enabled. Disabling port.
%PM-4-ERR_DISABLE: bpduguard error detected on Gi1/0/10, putting Gi1/0/10 in err-disable state

What is the best interpretation?

Options:

• A. Root guard shut down the port because PortFast was enabled.

• B. Loop guard blocked the port after BPDUs stopped arriving.

• C. BPDU guard protected an edge port by err-disabling it.

• D. Root guard blocked a superior BPDU in root-inconsistent state.

Best answer: C

Explanation: BPDU guard is used on edge ports, typically with PortFast, where BPDUs should not be received. If a BPDU arrives, BPDU guard treats that as evidence that a switch or bridge has been connected and places the port into the err-disabled state to protect the Layer 2 topology. Root guard has a different goal: preventing a port from becoming a root port when superior BPDUs are received, usually by moving it to root-inconsistent. Loop guard also differs: it protects against loops caused by a port unexpectedly stopping receipt of BPDUs, placing the port into loop-inconsistent rather than err-disabled. The key clue is the bpduguard err-disable message.

• Root-inconsistent state fits root guard, not the displayed bpduguard err-disable condition.
• Missing BPDUs is the loop guard trigger, but the log shows a BPDU was received.
• PortFast alone does not cause a shutdown; BPDU guard reacts when a BPDU appears on an edge port.

Question 37

Topic: Network Infrastructure and Connectivity

A laptop cannot join the corporate Wi-Fi SSID, but other users connect successfully. The WLAN is configured for WPA2-Personal using AES with passphrase NetOps-2026!. The laptop profile is set to WPA3-Personal with the same SSID. What is the best configuration response?

Options:

• A. Enable WEP on the laptop profile for compatibility.

• B. Configure a static IPv4 address on the laptop.

• C. Set the laptop profile to WPA2-Personal AES with the correct passphrase.

• D. Change the SSID on the access point for that laptop.

Best answer: C

Explanation: Wireless authentication must match between the client profile and the WLAN. In this case, the SSID is already reachable because other users connect successfully, so the likely issue is the laptop security profile. A WPA3-Personal client profile will not authenticate to a WLAN that is configured only for WPA2-Personal. The response should align the client profile with the WLAN’s authentication and encryption settings and use the configured passphrase.

Changing IP settings would not fix a failure to associate or authenticate to the wireless network. IP addressing is checked after the client successfully joins the WLAN.

• Changing the SSID changes the wrong scope because the WLAN already works for other clients.
• Enabling WEP uses an obsolete and mismatched security method instead of matching WPA2-Personal AES.
• Setting a static IP is premature because the client has not successfully authenticated to the WLAN.

Question 38

Topic: IP Routing

A branch LAN behind R1 (192.168.10.0/24) cannot ping an HQ LAN behind R2 (192.168.20.0/24). The R1-R2 transit link is up/up, and both routers run single-area OSPF area 0 on the transit link.

Exhibit: R2 verification

R2# show ip ospf neighbor
Neighbor ID     Pri   State       Address
1.1.1.1           1   FULL/BDR    10.0.12.1

R2# show ip route 192.168.10.0
Routing entry for 192.168.10.0/24
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 10.0.23.3

R1’s transit address is 10.0.12.1. What is the best root cause?

Options:

• A. R2 is missing a default route to R1

• B. The R1-R2 transit interface is down

• C. The OSPF area IDs do not match

• D. A stale static route on R2 overrides OSPF

Best answer: D

Explanation: OSPF adjacency problems usually show up as missing or non-FULL neighbors, but the exhibit shows R2 has a FULL adjacency with R1. The decisive clue is the route source for 192.168.10.0/24: R2 is using a static route with administrative distance 1 toward 10.0.23.3, not the R1 transit address 10.0.12.1. Because static routes are preferred over OSPF routes by default, this stale or incorrect static route can break the return path even when OSPF itself is operating correctly.

The key distinction is neighbor state versus route selection: OSPF can be healthy while the routing table still chooses a bad static route.

• Area mismatch would prevent a full neighbor adjacency, which is not what the exhibit shows.
• Interface down conflicts with the stated up/up transit link and the visible OSPF neighbor.
• Missing default route is not the best issue because R2 has a specific route for the branch LAN, but it points to the wrong next hop.

Question 39

Topic: IP Routing

R1 has two OSPF intra-area candidate paths to the same remote LAN. No route from another source competes for this prefix. Based on the summary, which path should R1 install?

Illustrative candidate-path summary:

Prefix           Type        Cost  Next hop       Interface
10.30.40.0/24     Intra-area  24    192.168.12.2   Gi0/0
10.30.40.0/24     Intra-area  48    192.168.13.3   Gi0/1

Options:

• A. Wait for an administrative distance change.

• B. Install the path through 192.168.13.3 on Gi0/1.

• C. Load-balance across both OSPF next hops.

• D. Install the path through 192.168.12.2 on Gi0/0.

Best answer: D

Explanation: Both candidates are OSPF intra-area paths to the same prefix, so the lower OSPF cost determines the preferred path. The path with cost 24 through 192.168.12.2 on Gi0/0 is preferred over the path with cost 48 through 192.168.13.3 on Gi0/1. No competing route source is present, so administrative distance does not change this choice. Equal-cost OSPF paths could be installed for load balancing, but these costs are unequal. The exhibit summarizes candidate paths rather than reproducing a particular IOS command’s output format.

• Higher metric fails because OSPF prefers the lower cost when the prefix and routing source are the same.
• Load balancing would require equal-cost paths, but the exhibit shows costs of 24 and 48.
• Administrative distance is not the deciding factor here because both candidate routes come from OSPF.

Question 40

Topic: Network Infrastructure and Connectivity

A user’s laptop cannot connect to the corporate wireless network. Other laptops on the same SSID are working. The help desk collected these clues:

SSID: Corp-WiFi
Client Wi-Fi status: Not connected
Client WLAN IPv4: no address; media disconnected
AP log for client MAC: 802.1X authentication failed; EAP method mismatch
SSID security: WPA2-Enterprise, VLAN 20

Which action best addresses the root cause?

Options:

• A. Configure a static IPv4 address in VLAN 20

• B. Correct the laptop’s WPA2-Enterprise 802.1X profile

• C. Troubleshoot the VLAN 20 default gateway

• D. Allow VLAN 20 on the AP switch trunk

Best answer: B

Explanation: Wireless troubleshooting should follow the connection sequence: authenticate and associate first, then obtain IP configuration, then test reachability. In this case, the client shows media disconnected and has no IPv4 address, but the decisive clue is the AP log showing an 802.1X EAP method mismatch. Because other clients on the same SSID work, the SSID, VLAN, and general infrastructure are likely functioning. The laptop’s wireless security profile must match the WPA2-Enterprise settings expected by the network before DHCP or gateway troubleshooting is meaningful.

The key takeaway is to fix the failed wireless security negotiation before changing IP addressing or switching configuration.

• Static addressing does not fix the authentication failure that prevents the wireless client from connecting.
• Gateway troubleshooting is premature because the client has not joined the WLAN or obtained Layer 3 connectivity.
• Trunk changes are unsupported because other clients on the same SSID and VLAN are working.

Question 41

Topic: IP Routing

Users in VLAN 30 report intermittent loss of connectivity to remote networks. Their default gateway is 10.30.0.1. The SVIs on both distribution switches are up/up.

Exhibit:

DSW1# show standby brief
Interface  Grp  Pri  State   Active  Standby  Virtual IP
Vlan30     30   110  Active  local   unknown  10.30.0.1

DSW2# show standby brief
Interface  Grp  Pri  State   Active  Standby  Virtual IP
Vlan30     31   100  Active  local   unknown  10.30.0.1

What is the best corrective action?

Options:

• A. Lower the HSRP priority on DSW1 below 100.

• B. Configure DSW2 to use HSRP group 30 on VLAN 30.

• C. Add a static default route on DSW2.

• D. Change client default gateways to 10.30.0.2.

Best answer: B

Explanation: HSRP routers must share the same HSRP group and virtual IP on the VLAN to form one redundancy group. The output shows DSW1 in group 30 and DSW2 in group 31, and each switch reports itself as Active with Standby unknown. That means the switches are not seeing each other as peers for the same HSRP group, so both can answer for the same virtual gateway IP using different HSRP virtual MAC behavior. Matching the group on VLAN 30 allows one switch to become active and the other to become standby. Priority only decides which peer is preferred after the peers are in the same group.

• Priority change does not fix separate HSRP groups; it only affects active election within the same group.
• Client gateway change would bypass the virtual gateway design and remove first-hop redundancy.
• Static routing is not supported by the shown evidence because the failure is at the first-hop redundancy layer.

Question 42

Topic: IP Routing

R1 has a static route for a remote LAN behind R2, but hosts behind R1 cannot reach 10.30.20.0/24. R2 is directly connected to R1 on GigabitEthernet0/0 with next-hop address 192.0.2.2.

Exhibit:

R1# show running-config | include ^ip route
ip route 10.30.20.0 255.255.255.0 GigabitEthernet0/1 192.0.2.2

R1# show ip interface brief | include GigabitEthernet0/[01]
GigabitEthernet0/0   192.0.2.1       YES manual up   up
GigabitEthernet0/1   198.51.100.1    YES manual up   up

What is the best next action?

Options:

• A. Change the outgoing interface to GigabitEthernet0/0.

• B. Change the next hop to 198.51.100.2.

• C. Remove the next-hop address from the static route.

• D. Change the route mask to 255.255.0.0.

Best answer: A

Explanation: A fully specified IPv4 static route must use a destination network, subnet mask, next-hop address, and exit interface that match the real forwarding path. The route is intended for 10.30.20.0/24, and the stated next hop is R2 at 192.0.2.2. Because R1’s 192.0.2.1 address is on GigabitEthernet0/0, that is the interface toward the next hop. The configured route incorrectly points out GigabitEthernet0/1, which is on a different subnet. Keep the destination, mask, and next hop, but correct the outgoing interface.

• Wider mask would route more destinations than required and does not fix the next-hop/interface mismatch.
• 198.51.100.2 next hop is unsupported by the facts; R2’s next-hop address is given as 192.0.2.2.
• Removing the next hop does not address that the configured exit interface points away from R2.

Question 43

Topic: IP Routing

R1 must reach the LAN behind R3, 192.168.30.0/24. R1 connects only to R2 on 10.12.0.0/30; R2 is 10.12.0.2. R2 then connects to R3. R1 has this static route, but the route is not installed because the next hop is unreachable from R1:

ip route 192.168.30.0 255.255.255.0 10.23.0.2

Which correction should be applied on R1?

Options:

• A. Use next hop 10.12.0.2 for the route.

• B. Use next hop 10.23.0.2 with a higher metric.

• C. Use R1 address 10.12.0.1 as the next hop.

• D. Use next hop 192.168.30.1 for the route.

Best answer: A

Explanation: A static route that uses a next-hop IP address must be able to resolve that next hop through the local routing table. R1 is directly connected only to the 10.12.0.0/30 link toward R2, so R1 can reach 10.12.0.2 directly. The current next hop, 10.23.0.2, is on the R2-to-R3 link and is not directly reachable from R1 unless R1 already has another route to that network. Pointing the route to R2’s adjacent interface lets R1 forward packets toward the remote LAN.

• Higher metric does not fix an unreachable next hop; the route still cannot resolve through R1’s routing table.
• Remote LAN gateway is beyond R2 and is not directly reachable from R1 as a next hop.
• Local interface address points the route back to R1 itself, not to the neighboring router.

Question 44

Topic: IP Routing

R1 currently forwards traffic for 10.10.20.0/24 through OSPF. A firewall connected to R1 at 192.0.2.6 must receive traffic for only host 10.10.20.50, while all other 10.10.20.0/24 traffic must keep using the existing OSPF path.

Exhibit: R1 route excerpt

C 192.0.2.4/30 is directly connected, GigabitEthernet0/1
O 10.10.0.0/16 [110/20] via 192.0.2.1, GigabitEthernet0/0
O 10.10.20.0/24 [110/30] via 192.0.2.1, GigabitEthernet0/0
S* 0.0.0.0/0 [1/0] via 203.0.113.1

Which IOS XE configuration decision meets the goal?

Options:

• A. Configure ip route 0.0.0.0 0.0.0.0 192.0.2.6.

• B. Configure ip route 10.10.20.50 255.255.255.255 192.0.2.6.

• C. Configure ip route 10.10.0.0 255.255.0.0 192.0.2.6.

• D. Configure ip route 10.10.20.0 255.255.255.0 192.0.2.6.

Best answer: B

Explanation: Routers choose the route with the longest matching prefix before considering administrative distance or metric. The current OSPF /24 route matches 10.10.20.50 and all other hosts in 10.10.20.0/24. Adding a static /32 host route for 10.10.20.50 creates a more specific match only for that single destination. Because 192.0.2.6 is on a directly connected subnet, it is a valid next hop for the static route.

The broader static routes would change forwarding for more destinations than the requirement allows.

• Static /24 sends the entire 10.10.20.0/24 subnet to the firewall, not only the single host.
• Static /16 affects many 10.10.x.x destinations and is less specific than the existing /24 for this host.
• Default route applies only when no more specific route matches, so it would not override the OSPF /24 route.

Question 45

Topic: Switching and Network Access

Two Cisco switches must be connected with a physical Ethernet link that carries VLAN 10 and VLAN 20 between them. The link must operate as a Layer 2 switch-to-switch connection, not as a routed port. Which interface configuration should be applied on both switch ports?

Options:

• A. ip routing on the interface

• B. switchport mode access in VLAN 10

• C. no switchport with an IP address

• D. switchport mode trunk and allow VLANs 10,20

Best answer: D

Explanation: A switch-to-switch Ethernet link that must carry more than one VLAN should be configured as a Layer 2 trunk. On Cisco switches, switchport mode trunk makes the physical interface operate as a Layer 2 trunk so VLAN-tagged traffic can cross the link. Restricting the allowed VLAN list to VLAN 10 and VLAN 20 matches the requirement and avoids carrying unnecessary VLANs.

A routed interface is used for Layer 3 forwarding between IP networks, while an access port carries traffic for a single VLAN. The key distinction is that the requirement asks for Ethernet switching between switches, so the port should remain a switchport.

• Routed port fails because no switchport changes the interface to Layer 3 and requires IP addressing.
• Access mode fails because it supports one VLAN on the link, not VLANs 10 and 20.
• Interface IP routing fails because routing is not configured directly on a Layer 2 switchport trunk.

Question 46

Topic: IP Routing

Users in VLAN 20 can reach local servers but cannot reach the branch application server at 10.30.5.25. From R1, an extended ping sourced from VLAN 20 fails, and traceroute sends the first packet to the ISP next hop.

Exhibit: R1 routing table excerpt

Gateway of last resort is 192.0.2.1 to network 0.0.0.0

C    10.20.20.0/24 is directly connected, Vlan20
O    10.10.0.0/16 [110/20] via 10.0.12.2, GigabitEthernet0/1
S*   0.0.0.0/0 [1/0] via 192.0.2.1, GigabitEthernet0/0

What is the best-supported root cause?

Options:

• A. VLAN 20 clients have the wrong default gateway.

• B. The directly connected VLAN 20 route is missing.

• C. R1 lacks a more-specific route to 10.30.5.25.

• D. The OSPF route to 10.10.0.0/16 has a bad metric.

Best answer: C

Explanation: Routers select the longest matching prefix for a destination. In the exhibit, 10.30.5.25 does not match the connected 10.20.20.0/24 route or the OSPF 10.10.0.0/16 route. Because no more-specific route exists, R1 falls back to the default route 0.0.0.0/0 and forwards traffic to 192.0.2.1, the ISP next hop. That matches the traceroute clue.

The fix would be to restore or add the appropriate route for the 10.30.5.25 network toward the branch, such as through OSPF or a static route.

• Wrong gateway is not supported because the failure is reproduced from R1 with a source in VLAN 20.
• Bad OSPF metric for 10.10.0.0/16 does not affect traffic to 10.30.5.25.
• Missing VLAN route is contradicted by the connected 10.20.20.0/24 entry in the routing table.

Question 47

Topic: Network Infrastructure and Connectivity

Users in VLAN 20 cannot obtain DHCPv4 addresses. The DHCP server is 10.10.50.10 in another subnet, and VLAN 20 uses SVI 10.10.20.1 as its default gateway.

Exhibit:

Dist1# show running-config interface vlan 20
interface Vlan20
 ip address 10.10.20.1 255.255.255.0
 no shutdown

Dist1# show ip route 10.10.50.10
Routing entry for 10.10.50.0/24
  Known via "ospf 1"

Dist1# ping 10.10.50.10 source vlan 20
!!!!!

What is the best next validation step?

Options:

• A. Verify an ip helper-address on Vlan20

• B. Verify the client default gateway address

• C. Verify OSPF has a default route

• D. Verify the DHCP server has an MX record

Best answer: A

Explanation: For DHCPv4 across a routed boundary, the key validation is DHCP relay on the client-facing Layer 3 interface. The exhibit shows that Dist1 can route to and ping the remote DHCP server from VLAN 20, so basic Layer 3 reachability is present. However, DHCP clients initially send broadcasts, and routers do not forward broadcasts by default. On Cisco IOS, the SVI or routed interface that receives the client broadcast needs an ip helper-address pointing to the DHCP server. Without it, the DHCP Discover never reaches 10.10.50.10 even though unicast routing works.

The key takeaway is to validate relay on the gateway interface, not general routing, when DHCP fails only across a routed boundary.

• Client gateway is not the best first check because clients cannot obtain leases yet, and the SVI gateway is already shown.
• OSPF default route is unnecessary because the exhibit shows a specific route and successful ping to the DHCP server.
• MX record applies to mail routing in DNS, not DHCP address assignment.

Question 48

Topic: Network Infrastructure and Connectivity

A router interface GigabitEthernet0/0 will be the default gateway for a new IPv6 LAN. The addressing plan assigns the LAN prefix 2001:db8:acad:12::/64, and the interface must use an address from that exact prefix. Which configuration decision meets the requirement?

Options:

• A. Configure 2001:db8:acad:13::1/64 on the interface.

• B. Configure 2001:db8:acad:12::1/64 on the interface.

• C. Configure 2001:db8:acad:1200::1/64 on the interface.

• D. Configure fe80::1/64 on the interface.

Best answer: B

Explanation: With an IPv6 /64, the first 64 bits are the network prefix. In standard notation, that means the first four hextets must match the assigned LAN prefix exactly: 2001:db8:acad:12. The remaining 64 bits identify the interface within that LAN. An address such as 2001:db8:acad:12::1/64 keeps the same first four hextets and uses ::1 as the interface ID, so it fits the plan. Addresses with a different fourth hextet, such as 13 or 1200, are in different /64 networks. A fe80::/10 address is link-local, not part of the assigned global unicast prefix.

• Different fourth hextet fails because 2001:db8:acad:13::/64 is a separate LAN prefix.
• Similar-looking hextet fails because 1200 is not the same 16-bit hextet as 12.
• Link-local address fails because fe80::/10 is not within the assigned global unicast prefix.

Question 49

Topic: Switching and Network Access

A campus switch block runs Rapid PVST+. SW1 is already the intended root bridge for VLANs 10 and 20. You need SW2 to become the backup root bridge for those same VLANs if SW1 fails, using the Cisco primary/secondary root behavior rather than manually calculating bridge priorities. Which global configuration command should be applied on SW2?

Options:

• A. spanning-tree vlan 10,20 port-priority 64

• B. spanning-tree vlan 10,20 root primary

• C. spanning-tree mode rapid-pvst

• D. spanning-tree vlan 10,20 root secondary

Best answer: D

Explanation: Rapid PVST+ elects a root bridge per VLAN based on the lowest bridge ID, which includes bridge priority and MAC address. Cisco IOS XE provides root bridge macros to simplify the intended design role. The root primary behavior is used on the switch that should normally be root for the specified VLANs. The root secondary behavior is used on the switch that should be the preferred backup root if the primary root is no longer present. Because SW1 is already intended to be the active root and SW2 must be the backup for VLANs 10 and 20, the secondary root command belongs on SW2 for those VLANs.

• Primary root would try to make SW2 the active root, which conflicts with SW1 being the intended root.
• Mode command enables Rapid PVST+ globally but does not assign a root role for specific VLANs.
• Port priority affects port role selection on a switch, not the bridge root election for VLANs.

Question 50

Topic: Network Infrastructure and Connectivity

A small office uses PAT on R1 for Internet access. After an ISP circuit change, LAN clients get DHCP addresses and can ping R1, but they cannot reach public IPv4 sites. The ISP confirms it is not providing upstream NAT.

Exhibit:

Client address: 10.10.10.25/24, gateway 10.10.10.1
R1 G0/0: 10.10.10.1/24, up/up, NAT inside
R1 G0/1: 172.20.50.2/30, up/up, NAT outside
Default route: 0.0.0.0/0 via 172.20.50.1
PAT: 10.10.10.0/24 overloads on G0/1

Which action addresses the most likely root cause?

Options:

• A. Add a DNS A record for the clients.

• B. Assign a public IPv4 address to G0/1.

• C. Change the client gateway to 172.20.50.1.

• D. Disable PAT for the 10.10.10.0/24 LAN.

Best answer: B

Explanation: RFC 1918 private IPv4 ranges are not routed on the public Internet: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. In this scenario, PAT translates client traffic to R1’s outside interface address, 172.20.50.2. Because 172.20.50.2 falls within 172.16.0.0 through 172.31.255.255, it is a private address. If the ISP is not performing another NAT step, return traffic from public destinations cannot route back to that private inside-global address. The edge router needs a globally routable public IPv4 address on the outside interface, or the provider must explicitly provide upstream NAT.

• Wrong gateway fails because clients already use the LAN interface as their default gateway and can ping R1.
• Disabling PAT would remove the translation needed for multiple private LAN clients to share an outside address.
• DNS record change does not address failure to route traffic translated to a private outside IPv4 address.

Questions 51-75

Question 51

Topic: Network Infrastructure and Connectivity

A Linux laptop cannot connect to the employee Wi-Fi network. Other clients on the same SSID are working. Review the client output:

$ nmcli device wifi connect EmployeeWiFi
Error: Connection activation failed: Secrets were required, but not provided

wpa_supplicant[821]: wlan0: CTRL-EVENT-SSID-TEMP-DISABLED
wpa_supplicant[821]: ssid="EmployeeWiFi" auth_failures=3 reason=WRONG_KEY

$ ip addr show wlan0
3: wlan0: <BROADCAST,MULTICAST> state DOWN

What is the best interpretation?

Options:

• A. The default gateway is unreachable

• B. The client has an incorrect subnet mask

• C. The DNS server is misconfigured

• D. Wireless security settings are failing

Best answer: D

Explanation: This symptom points to wireless security, not IP configuration or routed reachability. The Linux client has not successfully associated and authenticated to the SSID, and wpa_supplicant reports auth_failures with reason=WRONG_KEY. Because wlan0 remains down, the client has not reached the stage where DHCP, subnet mask, default gateway, or DNS troubleshooting would be the primary focus. The next practical check is to verify the SSID security type and the user’s PSK or 802.1X credentials against the WLAN configuration.

IP-layer tests become meaningful only after the wireless link is authenticated and the interface is up.

• Subnet mask issue fails because no active wireless interface or assigned IP configuration is shown.
• Gateway reachability is premature because the client has not authenticated to the WLAN.
• DNS misconfiguration would affect name resolution after connectivity exists, not Wi-Fi authentication.

Question 52

Topic: Switching and Network Access

A technician is validating Rapid PVST+ on switch SW3. Based only on the exhibit, what is the best interpretation for VLAN 20?

Exhibit:

SW3# show spanning-tree vlan 20
VLAN0020
  Spanning tree enabled protocol rstp
  Root ID    Priority    24596
             Address     001b.0caa.2000
             Cost        19
             Port        25 (GigabitEthernet1/0/1)

Interface           Role Sts Cost Prio.Nbr Type
------------------- ---- --- ---- -------- ----------------
Gi1/0/1             Root FWD   19 128.25   P2p
Gi1/0/2             Altn BLK   19 128.26   P2p
Gi1/0/24            Desg FWD    4 128.48   P2p

Options:

• A. SW3 is the root bridge because it has a designated port.

• B. Gi1/0/1 is the root port for VLAN 20.

• C. Gi1/0/24 is the root port because its port cost is lowest.

• D. Gi1/0/2 is the root port because it has the same cost.

Best answer: B

Explanation: In Rapid PVST+, each non-root switch selects one root port per VLAN: the port with the best path toward the root bridge. The exhibit gives two direct clues. In the Root ID section, the root path uses Port 25 (GigabitEthernet1/0/1). In the interface table, Gi1/0/1 has the Root role and is forwarding. An alternate port can have a similar displayed port cost but remains a backup path and is blocked. A designated port forwards away from the local switch onto a segment; it does not prove that the local switch is the root bridge.

• Same cost trap fails because Gi1/0/2 is marked Altn BLK, so it is a backup path, not the selected root port.
• Lowest link cost trap fails because Gi1/0/24 is Desg FWD; the role, not just the local port cost, identifies root-port selection.
• Designated port trap fails because non-root switches can still have designated ports on downstream segments.

Question 53

Topic: Network Services and Security

A company delegated the child zone branch.example.com from the parent zone example.com. After moving the child zone to a new DNS provider, public clients cannot resolve app.branch.example.com. What is the best next action based on the output?

Exhibit: DNS checks

$ dig NS branch.example.com @ns1.example.com +short
ns1.old-dns.example.net.
ns2.old-dns.example.net.

$ dig A app.branch.example.com @ns1.new-dns.example.net +short
198.51.100.25

$ dig A app.branch.example.com @ns1.old-dns.example.net +short
;; status: REFUSED

Options:

• A. Update the parent-zone NS delegation

• B. Flush the public resolver cache only

• C. Change the A record on the new provider

• D. Create a CNAME in the parent zone

Best answer: A

Explanation: The issue is an incorrect NS delegation. For a delegated child zone, public resolvers first learn which authoritative name servers to ask from the parent zone. The parent example.com zone still lists ns1.old-dns.example.net and ns2.old-dns.example.net for branch.example.com, but the record exists on ns1.new-dns.example.net. Because the old server refuses the query, clients following the parent delegation cannot reach the working authoritative server. The next action is to correct the NS records in the parent zone so the delegation points to the current authoritative DNS provider. Updating records inside the new child zone is not enough if resolvers are never directed there.

• A record change is unnecessary because the new authoritative server already returns the expected address.
• Parent CNAME is not the delegation mechanism for a child zone and would not replace the NS delegation.
• Cache flushing only may remove stale data, but it does not correct the authoritative delegation source.

Question 54

Topic: IP Routing

A router is providing first-hop redundancy for VLAN 10. Review the status output.

Exhibit:

R1# show standby brief
Interface   Grp  Pri P State   Active  Standby     Virtual IP
Gi0/0.10    10   110 P Active  local   192.0.2.3   192.0.2.1

Which interpretation is best?

Options:

• A. VRRP is running; 192.0.2.3 is the Master router.

• B. HSRP is running; R1 is Standby for group 10.

• C. VRRP is running; R1 is Master for group 10.

• D. HSRP is running; R1 is Active for group 10.

Best answer: D

Explanation: HSRP uses the terms Active and Standby, and Cisco IOS displays HSRP status with show standby. In the exhibit, the local router appears in the Active column as local, so R1 is currently forwarding for HSRP group 10. The Standby column lists 192.0.2.3, which is the peer ready to take over if the Active router fails. VRRP uses different operational terms, typically Master and Backup, and would be validated with VRRP-specific output rather than show standby. The protocol terminology in the output is the key clue.

• VRRP Master fails because VRRP uses Master/Backup terminology, not the displayed Active/Standby HSRP states.
• R1 as Standby misreads local under the Active column; the peer address appears under Standby.
• Peer as Master mixes VRRP terminology with HSRP output and ignores the Standby column.

Question 55

Topic: Network Infrastructure and Connectivity

A desktop user reports very slow file transfers after a NIC replacement. The switchport is hardcoded, and the desktop NIC is set to auto-negotiate.

Exhibit:

SW1# show interfaces gi1/0/18
GigabitEthernet1/0/18 is up, line protocol is up
  Full-duplex, 100Mb/s
  5 minute input rate 42000 bits/sec
  5 minute output rate 39000 bits/sec
  15238 input errors, 14980 CRC, 0 collisions

Desktop NIC status: 100Mb/s, half-duplex
Desktop NIC counters: late collisions increasing

The NIC supports auto-negotiation. Which correction is the safest first configuration decision?

Options:

• A. Enable storm control on the switchport

• B. Force only the switchport to 100Mb/s half-duplex

• C. Set both ends to auto-negotiate speed and duplex

• D. Replace the cable before changing duplex settings

Best answer: C

Explanation: A duplex mismatch commonly occurs when one side is hardcoded and the other side uses auto-negotiation. The auto side may detect speed but fall back to half-duplex, while the forced-full side stays full-duplex. Typical symptoms include poor throughput, CRC/input errors on the full-duplex side, and late collisions on the half-duplex side. Because the NIC supports auto-negotiation and there is no requirement to force settings, the safest correction is to configure both sides consistently for auto-negotiation, then verify the negotiated state and watch counters after clearing them. Changing only one side can preserve or create a mismatch.

• Switch-only half-duplex reduces capability and still changes only one side unless the endpoint is coordinated.
• Cable replacement is less supported because the exhibit directly shows conflicting duplex states.
• Storm control limits traffic bursts but does not correct speed or duplex negotiation.

Question 56

Topic: Network Infrastructure and Connectivity

A user in VLAN 10 can reach other hosts in the same VLAN but cannot reach remote networks. The default gateway for VLAN 10 is configured on R1. What is the best next action?

Exhibit:

PC1 IPv4 configuration
Address:         192.168.10.75
Subnet mask:     255.255.255.192
Default gateway: 192.168.10.1

R1 interface for VLAN 10
GigabitEthernet0/0.10: 192.168.10.65/26, up/up

Options:

• A. Change PC1 subnet mask to 255.255.255.0

• B. Set PC1 address to 192.168.10.130

• C. Set PC1 default gateway to 192.168.10.65

• D. Add a default route on PC1 to 192.168.10.0/26

Best answer: C

Explanation: With a 255.255.255.192 mask, the subnet size is 64 addresses. PC1 at 192.168.10.75 belongs to 192.168.10.64/26, with usable host addresses 192.168.10.65 through 192.168.10.126. The configured gateway 192.168.10.1 is in a different /26 subnet, so PC1 cannot use it as the Layer 3 next hop for remote networks. Since R1’s VLAN 10 interface is 192.168.10.65/26 and is up/up, PC1 should use 192.168.10.65 as its default gateway. The local VLAN reachability confirms the PC’s address is usable on the LAN; the gateway value is the problem.

• Widening the mask would change the subnet design and is not supported by the R1 interface configuration shown.
• Using .130 places PC1 in 192.168.10.128/26, which does not match the VLAN 10 gateway subnet.
• Adding a route to the local subnet does not provide a valid next hop for remote networks.

Question 57

Topic: Switching and Network Access

Two switches are connected on Gi1/0/24. VLANs 10, 20, and 99 exist on both switches. Hosts in VLAN 10 can communicate across the link, but hosts in VLAN 20 cannot.

Exhibit:

SW1# show interfaces trunk
Port        Status     Native vlan   Vlans allowed
Gi1/0/24    trunking   99            10,20,99

SW2# show interfaces trunk
Port        Status     Native vlan   Vlans allowed
Gi1/0/24    trunking   99            10,99

What is the best interpretation and next action?

Options:

• A. Change the native VLAN on SW1 to VLAN 20.

• B. Allow VLAN 20 on SW2 Gi1/0/24.

• C. Convert both switch ports to access ports in VLAN 20.

• D. Disable VLAN 99 on both switches.

Best answer: B

Explanation: The exhibit shows a working 802.1Q trunk on both sides with the same native VLAN, so the issue is not trunk formation or a native VLAN mismatch. The decisive difference is the allowed VLAN list: SW1 permits VLANs 10, 20, and 99, while SW2 permits only VLANs 10 and 99. Because VLAN 20 is not allowed on SW2’s trunk port, VLAN 20 frames will not pass across that side of the inter-switch link. The appropriate fix is to add VLAN 20 to the allowed VLAN list on SW2’s trunk interface while preserving the existing trunk configuration.

• Native VLAN change would introduce a mismatch because both sides already use native VLAN 99.
• Access port conversion would remove trunking and prevent multiple VLANs from crossing the link.
• Disabling VLAN 99 does not address why VLAN 20 is absent from SW2’s allowed list.

Question 58

Topic: Switching and Network Access

An engineer is validating switch-port documentation before making VLAN changes. The current document says SW1 Gi1/0/24 connects to PRN-Lobby at 10.10.20.50. Use the visible neighbor evidence to choose the documentation update.

Exhibit:

SW1# show cdp neighbors detail
Device ID: AP-Lobby
Entry address(es):
  IP address: 10.10.20.15
Platform: cisco C9120AXI, Capabilities: Trans-Bridge
Interface: GigabitEthernet1/0/24, Port ID: GigabitEthernet0

Options:

• A. Record SW1 Gi0 to AP-Lobby Gi1/0/24, C9120AXI, 10.10.20.15.

• B. Record SW1 Gi1/0/24 to AP-Lobby Gi0, C2960X, 10.10.20.15.

• C. Keep SW1 Gi1/0/24 documented to PRN-Lobby, 10.10.20.50.

• D. Record SW1 Gi1/0/24 to AP-Lobby Gi0, C9120AXI, 10.10.20.15.

Best answer: D

Explanation: CDP neighbor detail output can validate network documentation by showing what a directly connected Cisco device advertises. In this exhibit, Interface: GigabitEthernet1/0/24 is the local SW1 interface, while Port ID: GigabitEthernet0 is the neighbor’s interface. The Device ID, Platform, and IP address fields identify the neighbor as AP-Lobby, a Cisco C9120AXI access point, with management address 10.10.20.15. Documentation should be updated from the old printer entry to match the current neighbor evidence. The common trap is swapping the local interface and remote port ID.

• Swapped ports fails because Gi1/0/24 is SW1’s local interface, not the AP’s remote port.
• Old printer entry fails because the live CDP output contradicts the existing documentation.
• Wrong platform fails because the exhibit identifies the neighbor platform as cisco C9120AXI.

Question 59

Topic: Network Services and Security

A branch router should translate inside private addresses for Internet access. LAN clients in VLAN 10 can ping their default gateway, and R1 can ping the ISP next hop from its outside interface, but LAN clients cannot reach outside hosts.

Exhibit:

R1# show ip interface brief
Interface              IP-Address      Status  Protocol
Gi0/0                  192.168.10.1    up      up
Gi0/1                  203.0.113.2     up      up

R1# show run | section interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat inside

R1# show run | section interface GigabitEthernet0/1
 ip address 203.0.113.2 255.255.255.252
 ip nat outside

R1# show run | include ip nat|access-list|ip route
ip nat inside source list 10 interface GigabitEthernet0/1 overload
access-list 10 permit 192.168.20.0 0.0.0.255
ip route 0.0.0.0 0.0.0.0 203.0.113.1

Which corrective action best resolves the problem?

Options:

• A. Configure Gi0/1 with ip nat inside

• B. Add a default route toward 203.0.113.1

• C. Change ACL 10 to permit 192.168.10.0/24

• D. Set clients’ default gateway to 203.0.113.2

Best answer: C

Explanation: Dynamic PAT on IOS XE translates only traffic that matches the source list referenced by ip nat inside source. The interfaces are correctly marked as inside and outside, and the router already has a default route to the ISP. The decisive mismatch is that VLAN 10 clients use 192.168.10.0/24, while ACL 10 permits 192.168.20.0/24. Because the inside source addresses do not match the NAT ACL, no translation is created for those clients. Updating ACL 10 to permit the actual inside subnet allows the overload rule to translate their traffic through Gi0/1.

• Default route is already present, so adding another one does not fix the missing NAT match.
• Outside interface role is correct; changing Gi0/1 to inside would break the inside-to-outside NAT direction.
• Client gateway change would point clients at the ISP-facing address, not their local LAN gateway.

Question 60

Topic: IP Routing

R1, R2, and R3 run single-area OSPFv2. An administrator expects R1 to use R2 to reach 10.30.30.0/24, but traceroute from R1 goes through R3.

Exhibit: R1 output

R1# show ip ospf neighbor
Neighbor ID     Pri   State      Address      Interface
2.2.2.2           0   FULL/-     10.0.12.2    Gi0/0
3.3.3.3           0   FULL/-     10.0.13.3    Gi0/1

R1# show ip route 10.30.30.0
Routing entry for 10.30.30.0/24
  Known via "ospf 1", distance 110, metric 20
  * 10.0.13.3, from 3.3.3.3, GigabitEthernet0/1

Documented total OSPF costs:
R1-R2-destination: 30
R1-R3-destination: 20

Which explanation is best supported by the facts?

Options:

• A. The R2 OSPF adjacency is down.

• B. R3 has a lower administrative distance than R2.

• C. OSPF selected the lower-cost path through R3.

• D. R1 is using a default route instead of OSPF.

Best answer: C

Explanation: OSPF chooses the best route by comparing OSPF cost after the route is learned from valid neighbors. The neighbor table shows both R2 and R3 in FULL state, so the R2 adjacency is not the immediate problem. The routing table shows the prefix learned by OSPF with metric 20 via 10.0.13.3, which is R3. Because the documented R3 path cost is 20 and the R2 path cost is 30, R1 is behaving normally by installing the lower-cost OSPF route. If the design requires R2 to be preferred, adjust OSPF interface costs so the R2 path has the lower total cost.

• Adjacency down fails because R2 appears in FULL state in the OSPF neighbor table.
• Administrative distance fails because both paths are from the same OSPF process and use the same AD of 110.
• Default route fails because the route table shows a specific OSPF route to 10.30.30.0/24.

Question 61

Topic: Switching and Network Access

A user in VLAN 10 can ping the default gateway but cannot reach server 10.40.40.10. All routers in this lab reply to traceroute probes unless forwarding to the next hop fails. Which configuration scope should be checked or corrected first?

Topology: PC -> SW1 SVI -> R1 -> R2 -> Server VLAN

PC> tracert 10.40.40.10
 1  10.10.10.1
 2  172.16.12.2
 3  * * *
 4  * * *

Options:

• A. R2 server-facing VLAN

• B. PC access port VLAN

• C. R1-to-R2 routed segment

• D. SW1 VLAN 10 SVI

Best answer: C

Explanation: Traceroute identifies the path one Layer 3 hop at a time by increasing the TTL. The last device that replies is the last confirmed hop that the probe reached. Here, hop 1 is the SW1 SVI and hop 2 is R1. Because hop 3 and later do not respond, and the stem states that routers permit traceroute replies, the likely forwarding problem begins after R1. The first scope to check is the R1-to-R2 routed segment, such as R1’s outgoing interface, next-hop route, or the link to R2.

Do not start with the access VLAN or SVI because the probe already reached beyond them.

• Access VLAN is unlikely because the PC reaches its default gateway and farther routed hops.
• SW1 SVI is unlikely because hop 1 responds and forwards the probe to R1.
• Server VLAN is premature because the trace has not confirmed that probes reached R2.

Question 62

Topic: Network Services and Security

Users in VLAN 20 report that they cannot reach the internal web server at 198.51.100.50 using HTTPS. Other destinations work normally. An engineer verifies that the ACL below is applied inbound on the users’ router interface.

Exhibit:

R1# show running-config interface g0/1
interface GigabitEthernet0/1
 ip address 10.10.20.1 255.255.255.0
 ip access-group WEB-FILTER in

R1# show access-lists WEB-FILTER
Extended IP access list WEB-FILTER
 10 permit tcp 10.10.20.0 0.0.0.255 host 198.51.100.50 eq 80 (0 matches)
 20 deny ip 10.10.20.0 0.0.0.255 host 198.51.100.50 (46 matches)
 30 permit ip any any (1289 matches)

What is the best next action?

Options:

• A. Move the ACL from inbound to outbound on g0/1.

• B. Insert a permit for TCP port 443 before sequence 20.

• C. Add a TCP port 443 permit after sequence 30.

• D. Clear the ACL counters and retest the connection.

Best answer: B

Explanation: Extended ACLs are processed top down, and the first matching ACE determines the action. In the exhibit, sequence 10 permits only TCP destination port 80, which is HTTP. HTTPS traffic to 198.51.100.50 uses TCP destination port 443, so it does not match sequence 10. It then matches sequence 20, which denies all IP traffic from the VLAN 20 subnet to that host. The hit count on sequence 20 confirms that traffic is being blocked there. The fix is to place a more specific HTTPS permit before the deny ACE. Adding the permit later would not help because ACL processing stops at the earlier deny.

• Changing direction is not supported because the inbound ACL is already seeing and counting the denied user traffic.
• Clearing counters may help verify a later test, but it does not change the ACE that blocks HTTPS.
• Adding after the final permit fails because sequence 20 still denies the HTTPS flow before later entries are checked.

Question 63

Topic: Switching and Network Access

A switch has an SVI configured as the default gateway for VLAN 20, but hosts in that VLAN cannot ping it. Based on the output, what is the best next action?

SW1# show ip interface brief | include Vlan20
Vlan20                 192.168.20.1    YES manual up                    down

SW1# show vlan brief | include 20|Gi1/0/11|Gi1/0/12
20   USERS            active    Gi1/0/11, Gi1/0/12

SW1# show interfaces status | include Gi1/0/11|Gi1/0/12
Gi1/0/11  User-PC1      notconnect  20    auto  auto 10/100/1000BaseTX
Gi1/0/12  User-PC2      disabled    20    auto  auto 10/100/1000BaseTX

Options:

• A. Change the SVI IP address mask

• B. Configure a default route on SW1

• C. Enable or connect an active Layer 2 port in VLAN 20

• D. Create VLAN 20 in the VLAN database

Best answer: C

Explanation: An SVI can be configured and administratively up while still being operationally unusable if its line protocol is down. Here, VLAN 20 exists and is active, and the SVI has an IP address, so the problem is not that the VLAN is missing or the SVI lacks Layer 3 addressing. The interface evidence shows both VLAN 20 access ports are unusable: one is notconnect and the other is disabled. Without at least one active Layer 2 port in VLAN 20, or an active trunk carrying VLAN 20, the SVI line protocol remains down. The best fix is to make a VLAN 20 Layer 2 path operational.

• Missing VLAN is not supported because show vlan brief lists VLAN 20 as active.
• Default route would affect off-subnet forwarding, not whether the local SVI line protocol is up.
• Address mask change is unsupported because the exhibit shows a Layer 2 operational problem, not an IP subnet mismatch.

Question 64

Topic: Network Services and Security

A switch access port, Gi1/0/10, connects to an unmanaged IoT hub. Security policy requires the port to suppress broadcast, multicast, and unknown unicast traffic if any of those traffic types exceeds 5% of interface bandwidth. The port must remain a Layer 2 access port. Which configuration decision meets the goal?

Options:

• A. Configure switchport port-security maximum 5 on Gi1/0/10.

• B. Apply storm-control broadcast, multicast, and unicast level 5.00 on Gi1/0/10.

• C. Apply storm control on Vlan20 instead of Gi1/0/10.

• D. Apply storm-control broadcast level 5.00 only on Gi1/0/10.

Best answer: B

Explanation: Storm control protects a Layer 2 segment by monitoring traffic rates on a switch interface and suppressing selected traffic types when their configured threshold is exceeded. In this scenario, the requirement includes broadcast, multicast, and unknown unicast traffic, so each type must be configured on the physical access interface Gi1/0/10 with the 5% threshold. Keeping the port as a Layer 2 access port is compatible with storm control because the feature is applied directly under the switchport interface, not on an SVI or routed interface. Limiting only one traffic type or using port security would not meet the stated flooding-control requirement.

• Broadcast only fails because multicast and unknown unicast flooding would still be uncontrolled.
• SVI placement fails because storm control is intended for the physical Layer 2 switchport carrying the traffic.
• Port security fails because it limits learned MAC addresses, not broadcast, multicast, or unknown unicast rates.

Question 65

Topic: Switching and Network Access

A workstation on access port Gi1/0/12 in VLAN 30 cannot obtain an IPv4 address by DHCP. The DHCP server is reached through trunk Gi1/0/48 toward the distribution switch. You run simultaneous packet captures for 30 seconds.

Exhibit: Packet-capture summary

What is the best interpretation?

Options:

• A. The client is not sending DHCP Discover messages.

• B. VLAN 30 traffic is not being forwarded on the trunk.

• C. The DHCP server is rejecting the client MAC address.

• D. DHCP is failing because the client uses unicast requests.

Best answer: B

Explanation: The capture evidence separates client behavior from forwarding behavior. The client is generating DHCP Discover broadcasts, so the workstation and DHCP protocol start are working. Because those same frames are absent on the trunk that should carry VLAN 30 toward the DHCP server, the likely fault is Layer 2 forwarding or filtering on the access switch path, such as VLAN 30 not being allowed, not active, or not properly carried on the trunk.

The next practical check would be trunk and VLAN state, not DHCP server policy.

• Client silence fails because the access-port capture shows repeated DHCP Discover frames.
• Server rejection is unsupported because the Discover frames never appear on the trunk toward the server.
• Unicast DHCP fails because initial DHCP Discover messages are broadcasts, and the issue is their absence on the trunk.

Question 66

Topic: Network Services and Security

A remote employee on a company laptop cannot reach an internal HR application from a hotel network. The application is reachable from branch offices. Review the exhibit and choose the best next action.

Exhibit: VPN and firewall summary

User source: dynamic public IP from hotel Wi-Fi
Internal app: 10.20.30.15 TCP/443
Site-to-site VPNs: HQ-BR1 up, HQ-BR2 up
Remote-access VPN sessions: 0
Remote-access VPN profile: not configured
Firewall event: denied outside to inside 10.20.30.15:443

Options:

• A. Add another site-to-site VPN tunnel

• B. Configure CDP to verify the hotel connection

• C. Publish the HR application directly to the Internet

• D. Configure an IPsec remote access VPN profile

Best answer: D

Explanation: An IPsec remote access VPN is used when individual users need secure connectivity to private network resources over an untrusted network, such as home, hotel, or public Wi-Fi. The exhibit shows that branch site-to-site VPNs are already working, so the branch connectivity model is not the problem. It also shows the user has a dynamic public IP and no remote-access VPN profile exists, while direct outside-to-inside access is denied. That combination points to deploying a client-based remote access VPN rather than creating a fixed network-to-network tunnel or exposing the internal application. The key distinction is user-to-network access for one roaming endpoint versus site-to-site connectivity for fixed locations.

• Site-to-site tunnel is for connecting fixed networks, not a roaming hotel user with a dynamic address.
• Internet publishing increases exposure and does not provide the private encrypted user access described.
• CDP verification is irrelevant across the hotel Internet path and does not solve remote user access.

Question 67

Topic: Network Infrastructure and Connectivity

A user reports that a laptop stays connected to the corporate SSID but web pages load slowly and video calls drop. Other nearby wired users are unaffected. Use the wireless client summary to choose the best interpretation or next action.

Exhibit:

Client MAC: 88aa.bbcc.ddee
SSID: CorpNet
Band/Channel: 2.4 GHz / channel 6
Security state: WPA2-Enterprise authenticated
IPv4 address: 10.20.30.44 via DHCP
RSSI: -55 dBm
Noise: -62 dBm
SNR: 7 dB
Channel utilization: 91%
Retry rate: 46%
Adjacent APs: channel 1 and 11 available

Options:

• A. Move the client to a cleaner channel or 5 GHz

• B. Replace the DHCP scope for the SSID

• C. Reset the user password for WPA2-Enterprise

• D. Increase transmit power on channel 6

Best answer: A

Explanation: The client is successfully authenticated and has a DHCP address, so the main problem is not security or IP assignment. The RF indicators point to a wireless medium problem: RSSI of -55 dBm is usable, but noise of -62 dBm leaves only 7 dB of SNR. High channel utilization and a 46% retry rate mean frames are frequently contending or being retransmitted on the 2.4 GHz channel. A better next action is to use a cleaner channel, steer the client to 5 GHz if supported, or investigate local interference sources. Raising transmit power usually does not fix noise or contention and can make co-channel interference worse.

• Password reset is not supported because the client is already WPA2-Enterprise authenticated.
• DHCP scope change is not supported because the client already received an IPv4 address.
• More transmit power does not address high noise, utilization, or retries on the channel.

Question 68

Topic: Switching and Network Access

A standalone wireless access point is connected to Gi1/0/12. It will broadcast one employee SSID and bridge clients into VLAN 30. The AP sends both client and management traffic untagged over this link, and both must belong to VLAN 30. The AP is powered from the switch. Based on the output, what is the best next action for the switch port?

Exhibit:

Switch# show interfaces gi1/0/12 switchport
Administrative Mode: dynamic auto
Operational Mode: static access
Access Mode VLAN: 1 (default)
Voice VLAN: none

Switch# show power inline gi1/0/12
Interface  Admin  Oper  Power  Device
Gi1/0/12   auto   on    15.4W  AIR-AP

Options:

• A. Convert the interface to a routed port in VLAN 30.

• B. Configure an 802.1Q trunk allowing VLAN 30 with native VLAN 1.

• C. Add the interface to an LACP EtherChannel.

• D. Configure an access port in VLAN 30 and keep PoE enabled.

Best answer: D

Explanation: The required switch-port configuration follows the AP’s tagging and VLAN requirements. Here, all traffic on the AP uplink is untagged and belongs to VLAN 30, so a static access port in VLAN 30 meets the requirement. The exhibit shows working PoE but access VLAN 1, which places the AP traffic in the wrong VLAN. Keep PoE enabled and correct the VLAN assignment. A trunk can be appropriate for other AP designs, including a single SSID with a separate management VLAN; the number of SSIDs alone does not determine the switch-port mode.

• Trunk with native VLAN 1 does not map the AP’s untagged traffic to VLAN 30. Allowing tagged VLAN 30 on the trunk does not fix that mismatch.
• Routed port mismatch fails because the AP needs Layer 2 VLAN membership, not a Layer 3 switch interface.
• EtherChannel unnecessary fails because the exhibit shows a single AP uplink with no aggregation requirement.

Question 69

Topic: Network Infrastructure and Connectivity

Host A has IPv4 address 10.20.30.126/25 and Host B has 10.20.30.129/25. Both are connected to access ports on the same Layer 2 switch. Their IP addresses and /25 masks must remain unchanged. Which configuration decision is required for the hosts to communicate correctly?

Options:

• A. Add a static ARP entry on the switch

• B. Configure a trunk between the host ports

• C. Route between the two /25 subnets

• D. Keep both hosts in one access VLAN only

Best answer: C

Explanation: With a /25 mask, the subnet size is 128 addresses. The subnet boundaries are 10.20.30.0/25 through 10.20.30.127/25, and 10.20.30.128/25 through 10.20.30.255/25. Host A at .126 is in the first subnet, while Host B at .129 is in the second subnet. Because they are not in the same IPv4 subnet, they should not communicate as local peers using only Layer 2 switching. Each host must send traffic toward a default gateway, and a router or Layer 3 switch must route between the two subnets.

• Same VLAN only fails because a VLAN does not merge separate IPv4 subnet boundaries.
• Host trunking is inappropriate because end hosts on access ports do not need an 802.1Q trunk for this issue.
• Static ARP fails because ARP resolves local subnet neighbors, not routing between different IPv4 networks.

Question 70

Topic: Switching and Network Access

A help desk ticket reports that a desktop connected to switch port Gi1/0/12 cannot reach the user network. The desktop should be an ordinary edge host in VLAN 20, not a phone, AP, switch, or virtualized host uplink. What is the best next action based on the exhibit?

Exhibit:

SW1# show interfaces gi1/0/12 switchport
Name: Gi1/0/12
Administrative Mode: trunk
Operational Mode: trunk
Access Mode VLAN: 20 (Users)
Trunking Native Mode VLAN: 1 (default)
Trunking VLANs Enabled: 1,20,30

Options:

• A. Configure the port as an access port in VLAN 20.

• B. Allow only VLAN 20 on the trunk.

• C. Change the trunk native VLAN to VLAN 20.

• D. Move the desktop to VLAN 1.

Best answer: A

Explanation: The exhibit shows that Gi1/0/12 has Access Mode VLAN: 20, but the port is administratively and operationally a trunk. The access VLAN setting is used when the port operates as an access port; it does not make an active trunk behave like a normal untagged desktop edge port. For an ordinary edge host, the port should be configured as an access port and assigned to the intended VLAN, such as switchport mode access with switchport access vlan 20. Trunk settings are appropriate for links that carry multiple VLANs to another switch, AP, phone design, firewall, or virtualization host uplink. The key distinction is operational mode: access for one untagged edge-host VLAN, trunk for multiple VLANs with tagging.

• Changing the native VLAN still leaves the port operating as a trunk, which is not the intended edge-host mode.
• Restricting the allowed VLAN list does not convert the link into an access port for a desktop.
• Moving the desktop to VLAN 1 ignores the stated requirement that the user network is VLAN 20.

Question 71

Topic: Network Services and Security

A Cisco IOS XE switch already has SSH enabled. Management access must use a local account named netadmin with full administrative privilege, and VTY logins must check the switch’s local user database. Which configuration decision meets the requirement?

Options:

• A. Create username netadmin privilege 15 secret <pw> and configure VTY login local.

• B. Create enable secret <pw> and configure VTY login.

• C. Create username netadmin password <pw> and configure console login local.

• D. Enable aaa new-model and configure VTY authentication with TACACS+.

Best answer: A

Explanation: For local management authentication on IOS XE, the device needs a local username entry and the management lines must be told to use that local database. The username ... secret command stores the account with a protected secret, and privilege 15 gives the user full administrative access after login. Applying login local under line vty makes SSH VTY sessions authenticate against those local usernames. Since SSH is already enabled in the scenario, the deciding configuration is the local user plus VTY authentication method, not SSH key generation or external AAA.

• Enable secret only protects privileged EXEC mode but does not create a per-user login account for VTY authentication.
• Console scope affects local console access, not SSH sessions that arrive on VTY lines.
• TACACS+ AAA uses an external authentication service, which conflicts with the requirement to use local credentials only.

Question 72

Topic: Network Services and Security

A router configuration backup job fails after an engineer changes the destination from an old file server to a secured management server. The security policy requires encrypted file transfers.

Clues:

R1# copy running-config tftp://10.20.30.10/R1.cfg
%Error opening tftp://10.20.30.10/R1.cfg (Timed out)

R1# ping 10.20.30.10
Success rate is 100 percent

Mgmt ACL: permit tcp any host 10.20.30.10 eq 22
Mgmt ACL: deny udp any host 10.20.30.10 eq 69 log
Server note: SCP/SFTP enabled, TFTP disabled

Which action is the best corrective action?

Options:

• A. Permit UDP port 69 through the management ACL

• B. Back up the configuration using SCP or SFTP

• C. Retry the backup after changing the router default gateway

• D. Use FTP because the server is reachable by ping

Best answer: B

Explanation: The backup is failing because the attempted method is TFTP, which uses UDP port 69 and is disabled or blocked in the management path. The router can reach the server by IP, so basic Layer 3 connectivity is not the issue. The visible ACL permits TCP port 22, and the server supports SCP/SFTP, both of which provide secure file transfer over SSH. For configuration backup, restore, or software file management where encryption is required, SCP or SFTP is the appropriate action.

Opening TFTP would weaken the security posture and still conflict with the server note that TFTP is disabled.

• Permit TFTP fails because UDP 69 is intentionally denied and TFTP does not meet the encrypted-transfer requirement.
• Change the gateway is unsupported because ping to the server already succeeds.
• Use FTP fails because FTP is not encrypted and server reachability alone does not satisfy the security policy.

Question 73

Topic: Switching and Network Access

Users in VLAN 20 on SW2 cannot reach the DHCP server connected behind SW1. Users in VLAN 10 on the same switches work normally. The link between SW1 and SW2 is Gi0/1 on both switches.

Exhibit: trunk check

SW1# show interfaces trunk
Port    Mode   Status     Native vlan
Gi0/1   on     trunking   99
Port    Vlans allowed on trunk
Gi0/1   10,20,99

SW2# show interfaces trunk
Port    Mode   Status     Native vlan
Gi0/1   on     trunking   99
Port    Vlans allowed on trunk
Gi0/1   10,99

Options:

• A. Change the native VLAN on SW1 Gi0/1 to VLAN 20.

• B. Change SW1 Gi0/1 from trunk mode to dynamic auto.

• C. Configure SW2 Gi0/1 as a routed Layer 3 interface.

• D. Add VLAN 20 to the allowed VLAN list on SW2 Gi0/1.

Best answer: D

Explanation: The evidence points to an allowed-VLAN issue, not a trunk formation or native VLAN problem. Both sides show Gi0/1 in trunking status, so the trunk is operational. Both sides also use native VLAN 99, so there is no native VLAN mismatch shown. VLAN 10 works because it is allowed on both trunks. VLAN 20 fails because it is allowed on SW1 but missing from SW2’s allowed VLAN list. Restoring VLAN 20 to the allowed list on SW2 Gi0/1 permits VLAN 20 frames to traverse the trunk.

• Native VLAN change is unsupported because both switches already show native VLAN 99.
• Routed interface would remove Layer 2 trunking and would not carry VLAN-tagged traffic between switches.
• Dynamic auto is weaker because the current output already proves the link is trunking.

Question 74

Topic: AI, Network Operations and Management

Users on access switch SW1 report that VLAN 20 clients are receiving APIPA addresses. The DHCP server is reached through distribution switch DSW1 on uplink Gi1/0/48, and the VLAN 20 SVI on DSW1 already has the correct helper address. A digital network assistant recommends automatically disabling DHCP snooping for VLAN 20.

Exhibit:

SW1# show ip dhcp snooping
DHCP snooping is enabled
DHCP snooping VLANs: 20
Trusted interfaces: Gi1/0/48

SW1# show interfaces trunk
Port        Mode   Status    Allowed vlans
Gi1/0/48    on     trunking  10,30

What is the best next action supported by the evidence?

Options:

• A. Configure a helper address on the VLAN 20 SVI

• B. Add VLAN 20 to the trunk after validation

• C. Reload SW1 to clear DHCP snooping bindings

• D. Approve disabling DHCP snooping on VLAN 20

Best answer: B

Explanation: Agentic AI can assist troubleshooting, but its proposed configuration changes should be validated against network evidence before being applied. Here, DHCP snooping is enabled for VLAN 20, but the uplink to DSW1 is already trusted, so snooping is not the supported root cause. The trunk output shows Gi1/0/48 allows only VLANs 10 and 30, which prevents VLAN 20 DHCP traffic from reaching the distribution switch and its helper address. The evidence supports correcting the trunk allowed VLAN list through normal change control, not blindly accepting the assistant’s autonomous change.

• Disabling snooping is unsupported because the DHCP path uses a trusted uplink and removing snooping weakens security.
• Adding a helper is unnecessary because the stem states the VLAN 20 SVI already has the correct helper address.
• Reloading SW1 is disruptive and does not address the missing VLAN on the trunk.

Question 75

Topic: Network Services and Security

An engineer must back up R1’s running configuration to a file server. The security requirement says the transfer must protect both credentials and file contents in transit. Review the exhibit and choose the best next action.

Exhibit:

R1# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 120 secs; Authentication retries: 3

R1# ping 192.0.2.50
Success rate is 100 percent (5/5)

R1# copy running-config tftp://192.0.2.50/R1-running.cfg
Destination filename [R1-running.cfg]?
!!!!!
[OK - 4821 bytes]

Options:

• A. Repeat the backup using SCP to 192.0.2.50

• B. Keep the completed TFTP backup

• C. Disable SSH and retry the transfer

• D. Repeat the backup using FTP to 192.0.2.50

Best answer: A

Explanation: SCP is the appropriate secure file transfer method when a device configuration or software file must be protected in transit. In the exhibit, the router successfully used TFTP, but TFTP does not encrypt credentials or file data. The same exhibit also shows SSH version 2 is enabled and the target server is reachable, which supports using SCP for the required secure copy behavior. FTP would still expose credentials and data, and disabling SSH would remove the transport SCP depends on. The key distinction is that a successful transfer is not enough when the requirement specifically calls for secure transfer.

• TFTP success is not sufficient because TFTP sends the configuration without encryption.
• FTP retry fails the security requirement because FTP does not protect credentials or file contents.
• Disabling SSH prevents SCP from working because SCP relies on SSH transport.

Questions 76-100

Question 76

Topic: Network Services and Security

A campus access switch supports dual-stack user VLAN 30. Users report intermittent IPv6 connectivity because a workstation is advertising itself as an IPv6 default gateway. The legitimate router connects through a trunk uplink; user devices connect to access ports. Which Layer 2 security configuration decision best addresses this threat?

Options:

• A. Apply RA guard on user access ports

• B. Enable DHCP snooping on VLAN 30

• C. Configure storm control on access ports

• D. Enable Dynamic ARP Inspection on VLAN 30

Best answer: A

Explanation: RA guard is the Layer 2 protection designed to stop rogue IPv6 Router Advertisement messages from untrusted host-facing ports. In this scenario, the threat is not address assignment, ARP spoofing, or excessive broadcast traffic; it is an unauthorized device claiming to be the IPv6 default gateway. The correct placement is on user access ports, while the legitimate router-facing uplink must be allowed to send valid RAs. The key takeaway is to match the feature to the specific Layer 2 threat, not just enable a generic access-layer security feature.

• DHCP snooping protects against rogue DHCP servers and builds a binding table, but IPv6 RAs are not DHCP messages.
• Dynamic ARP Inspection validates ARP traffic for IPv4, but it does not inspect IPv6 Router Advertisements.
• Storm control limits broadcast, multicast, or unknown unicast rates, but it does not identify a rogue IPv6 gateway advertisement.

Question 77

Topic: Switching and Network Access

After a new access switch is added, users in VLAN 20 still have connectivity, but the expected uplink on SW1 is not the forwarding path. Review the Rapid PVST+ evidence.

SW1# show spanning-tree vlan 20
Root ID    Priority 24596
           Address 001e.7a11.2222
           Cost 4
           Port Gi1/0/1
Bridge ID  Priority 32788
           Address 001e.7a11.1111

SW2# show spanning-tree vlan 20
Root ID    Priority 24596
           Address 001e.7a11.2222
Bridge ID  Priority 24596
           Address 001e.7a11.2222
           This bridge is the root

Which switch is the root bridge for VLAN 20?

Options:

• A. SW2

• B. Cannot be determined from this output

• C. The new access switch

• D. SW1

Best answer: A

Explanation: In Rapid PVST+, each VLAN elects one root bridge based on the lowest bridge ID, which includes bridge priority and MAC address. The decisive evidence is the Root ID. On SW1, the Root ID is 001e.7a11.2222, while SW1’s own Bridge ID is 001e.7a11.1111, so SW1 is not the root and has a root port toward the root. On SW2, the Bridge ID matches the Root ID, and the output explicitly says This bridge is the root. A non-root switch has a root port; the root bridge does not need one for that VLAN.

• SW1 as root fails because SW1 lists a separate Root ID and shows Gi1/0/1 as its root port.
• New access switch is unsupported because no displayed bridge ID or Root ID points to that switch.
• Cannot determine fails because SW2’s output directly identifies itself as the root bridge.

Question 78

Topic: Network Services and Security

A dual-stack web server should be reachable as app.corp.example over IPv6. Clients can ping the server’s IPv6 address directly, and the default gateway for the client VLAN is reachable over IPv6. DNS testing shows this result:

Server IPv6 address: 2001:db8:10:20::50
nslookup -type=A app.corp.example   -> 192.0.2.50
nslookup -type=AAAA app.corp.example -> No answer

What is the best corrective action?

Options:

• A. Change the A record to 2001:db8:10:20::50.

• B. Add a PTR record for 2001:db8:10:20::50.

• C. Create an AAAA record for app.corp.example.

• D. Enable DHCPv6 on the client VLAN.

Best answer: C

Explanation: An AAAA record maps a hostname to an IPv6 address. The network path is already partly validated because clients can ping the server’s IPv6 address directly and can reach their IPv6 default gateway. The failure appears only when resolving the hostname for IPv6: the A query returns an IPv4 address, while the AAAA query returns no answer. The DNS zone needs an AAAA record for app.corp.example that points to 2001:db8:10:20::50. An A record is only for IPv4, and a PTR record supports reverse lookup rather than forward hostname-to-address resolution.

• Changing the A record fails because A records contain IPv4 addresses, not IPv6 addresses.
• Adding a PTR record fails because it helps reverse DNS lookup, not normal hostname resolution.
• Enabling DHCPv6 is unsupported because direct IPv6 connectivity is already working from the clients.

Question 79

Topic: Switching and Network Access

A network engineer is building Port-channel5 as a Layer 2 802.1Q trunk between SW1 and SW2. The bundle must use LACP, and the cabling and trunk VLAN settings have been verified.

Exhibit:

SW1 Gi1/0/1-2:
  switchport mode trunk
  channel-group 5 mode active

SW2 Gi1/0/1-2:
  switchport mode trunk
  channel-group 5 mode on

SW1# show etherchannel summary
Po5(SD)  Gi1/0/1(I)  Gi1/0/2(I)

Which configuration decision should the engineer make?

Options:

• A. Change SW1 to static on mode

• B. Configure switchport mode access on both port channels

• C. Change SW2 to LACP active or passive mode

• D. Convert Port-channel5 to a Layer 3 routed interface

Best answer: C

Explanation: LACP EtherChannel forms only when the participating interfaces use compatible LACP modes. active actively sends LACP packets, and passive responds to LACP; on creates a static EtherChannel and does not run LACP. In the exhibit, SW1 is trying to negotiate with LACP, but SW2 is configured for a static bundle, so SW1 leaves the member links as individual ports and the port channel is down. Because the goal is a Layer 2 802.1Q trunk using LACP, the fix is to configure SW2 member interfaces with an LACP mode that can negotiate with SW1. Changing the bundle type or port layer would not meet the stated goal.

• Static mode could create a non-negotiated EtherChannel, but it violates the requirement to use LACP.
• Access mode removes trunking and would not carry the required 802.1Q VLANs.
• Layer 3 conversion changes the port channel purpose and would not provide a Layer 2 trunk.

Question 80

Topic: Network Infrastructure and Connectivity

A small office uses three 2.4-GHz APs in adjacent rooms. Clients remain associated and receive DHCP addresses, but throughput drops and video calls freeze during busy hours.

Survey summary:

Which corrective action best addresses the likely root cause?

Options:

• A. Reassign the APs to channels 1, 6, and 11

• B. Increase AP transmit power on all three APs

• C. Disable WPA2 encryption on the SSIDs

• D. Shorten the DHCP lease time for wireless clients

Best answer: A

Explanation: In the 2.4-GHz band, channel selection directly affects co-channel and adjacent-channel interference. The clients have strong RSSI and valid DHCP addresses, so the symptom is not mainly weak signal or IP assignment failure. The high retry rates combined with APs on channels 6, 7, and 8 point to overlapping-channel interference. In 2.4 GHz, the common nonoverlapping channel plan is 1, 6, and 11, which helps nearby APs avoid interfering with each other.

The key takeaway is that stronger signal is not always better; clean channel planning often improves performance more than increasing power.

• More power can increase cell overlap and interference when RSSI is already strong.
• DHCP lease changes do not address high wireless retry rates after clients already obtain addresses.
• Disabling encryption is not a valid performance fix and would weaken WLAN security.

Question 81

Topic: Network Services and Security

Several LAN clients in 10.10.10.0/24 use R1 for Internet access. After a NAT change, one client can browse the Internet, but other clients cannot start new Internet sessions.

Exhibit:

R1# show ip interface brief | include GigabitEthernet0/[01]
GigabitEthernet0/0   10.10.10.1     up  up
GigabitEthernet0/1   203.0.113.10    up  up

R1# show running-config | include ip nat|access-list 10|ip route
ip nat inside source list 10 interface GigabitEthernet0/1
access-list 10 permit 10.10.10.0 0.0.0.255
ip route 0.0.0.0 0.0.0.0 203.0.113.1

R1# show ip nat translations
Pro  Inside global   Inside local    Outside local  Outside global
---  203.0.113.10    10.10.10.25     ---            ---

Which corrective action is best supported by the evidence?

Options:

• A. Reverse the NAT inside and outside interfaces

• B. Add a default route toward 10.10.10.1

• C. Change ACL 10 to permit only one host

• D. Add overload to the NAT statement

Best answer: D

Explanation: The evidence points to NAT using the outside interface address without PAT. ACL 10 permits the whole inside subnet, the outside interface has a usable address, and a default route already sends Internet-bound traffic to the ISP. However, the NAT rule lacks overload, and the translation table shows a single inside local address mapped directly to 203.0.113.10 with no port-level sharing. PAT uses overload so many inside hosts can share one inside global address by tracking transport-layer ports. Adding overload changes the rule from one-address dynamic NAT behavior to PAT for the permitted LAN subnet.

• ACL narrowing would make access worse because the current ACL already permits the whole LAN subnet.
• Interface reversal is not supported because a working translation exists from an inside local address to the outside interface address.
• Default route change is incorrect because the router already has a default route toward the ISP next hop.

Question 82

Topic: Switching and Network Access

A user in VLAN 20 reports that the application server at 10.50.5.20 is unreachable by IP address. The user can ping the VLAN 20 default gateway, 10.20.20.1. On DSW1, VLAN 20 is up/up and a default route points upstream.

Exhibit:

DSW1# ping 10.50.5.20
Success rate is 100 percent (5/5)

DSW1# ping
Protocol [ip]:
Target IP address: 10.50.5.20
Source address or interface: Vlan20
Success rate is 0 percent (0/5)

Which conclusion or next action is best supported by these results?

Options:

• A. Add a default route on DSW1

• B. Recreate VLAN 20 on all access switches

• C. Troubleshoot DNS resolution for the server name

• D. Check upstream routing or filtering for 10.20.20.0/24

Best answer: D

Explanation: Extended ping is useful when a device has multiple interfaces because a normal ping may use the egress interface address as the source. Here, DSW1 can reach 10.50.5.20 with a normal ping, but the same target fails when the source is Vlan20. That means basic upstream reachability from DSW1 exists, but traffic using the VLAN 20 source address does not succeed. The likely issue is outside the local VLAN: an upstream ACL, firewall rule, or missing return route for 10.20.20.0/24. The successful host-to-gateway ping also reduces the likelihood of a local VLAN or SVI failure.

• Recreating VLAN 20 is not supported because the user can reach the VLAN 20 gateway and the SVI is up.
• Adding a default route is unlikely because DSW1 already reaches the server with a normal ping.
• Troubleshooting DNS does not match the symptom because the test uses the server IP address directly.

Question 83

Topic: Switching and Network Access

A network printer connected to edge switch port Gi1/0/18 should be in the printer VLAN. The printer does not receive a DHCP address and falls back to an APIPA address. Other printers in the same area work normally.

Exhibit:

SW1# show interfaces gi1/0/18 status
Port        Name      Status    Vlan  Duplex  Speed  Type
Gi1/0/18    Printer7  connected 10    a-full  a-1000 10/100/1000BaseTX

SW1# show vlan brief | include 10|30
10   USERS      active  Gi1/0/18, Gi1/0/19
30   PRINTERS   active  Gi1/0/21, Gi1/0/22

DHCP scopes: VLAN 10 = users only; VLAN 30 = printers

Which corrective action best addresses the root cause?

Options:

• A. Add a DHCP scope for printers in VLAN 10.

• B. Change the printer default gateway to VLAN 10.

• C. Configure Gi1/0/18 as an 802.1Q trunk.

• D. Configure Gi1/0/18 as an access port in VLAN 30.

Best answer: D

Explanation: The evidence points to an edge-port VLAN membership problem, not a physical link issue. Gi1/0/18 is connected and negotiating normally, but show interfaces status and show vlan brief both show the printer port in VLAN 10. The requirement and DHCP scope information say printers belong in VLAN 30. Because DHCP broadcasts stay within the local VLAN unless relayed, a printer placed in the user VLAN will not use the intended printer scope. The appropriate fix is to make the edge port an access port assigned to VLAN 30, then renew the printer address. Trunking is for carrying multiple VLANs between network devices, not for a typical single-VLAN printer port.

• Trunking the port is inappropriate for a standard printer edge connection and does not match the single intended VLAN.
• Adding a VLAN 10 printer scope works around the symptom but violates the stated VLAN design.
• Changing the gateway does not solve DHCP placement because the printer is still connected to the wrong VLAN.

Question 84

Topic: IP Routing

Two IOS XE routers provide HSRP for VLAN 20. R1 should be the active gateway during normal operation, but R2 should take over if R1’s upstream interface GigabitEthernet0/0 goes down.

R1 Vlan20: 172.16.20.2/24, HSRP group 20, virtual IP 172.16.20.1, priority 110, preempt
R2 Vlan20: 172.16.20.3/24, HSRP group 20, virtual IP 172.16.20.1, priority 100, preempt

Which configuration decision meets the goal?

Options:

• A. On R1 Vlan20, track GigabitEthernet0/0 with decrement 5

• B. On R1 Vlan20, track Vlan20 with decrement 20

• C. On R1 Vlan20, track GigabitEthernet0/0 with decrement 20

• D. On R2 Vlan20, track GigabitEthernet0/0 with decrement 20

Best answer: C

Explanation: HSRP interface tracking adjusts a router’s effective priority when a tracked interface fails. In this case, R1 starts at priority 110 and R2 is priority 100. To make R2 take over after R1’s upstream failure, R1 must reduce its priority below 100 when GigabitEthernet0/0 fails. Applying tracking under R1’s HSRP-enabled Vlan20 interface with a decrement of 20 changes R1’s effective priority to 90. Because both routers have preempt enabled, R2 can become active when it has the higher priority. Tracking the LAN SVI or configuring the wrong router does not detect the upstream reachability problem from R1’s perspective.

• Wrong router fails because tracking R2’s interface does not lower R1’s priority when R1 loses its upstream path.
• Wrong interface fails because tracking Vlan20 detects the client VLAN state, not R1’s upstream failure.
• Insufficient decrement fails because reducing R1 from 110 to 105 still leaves it higher than R2’s priority of 100.

Question 85

Topic: IP Routing

R1 and R2 are connected directly on Gi0/0. Both interfaces are up/up and can ping each other. The goal is to form a single-area OSPFv2 adjacency in area 0 without changing IP addressing.

Exhibit:

R1# show ip ospf interface gi0/0 | include Internet|Area
  Internet Address 10.12.0.1/30, Area 0

R2# show ip ospf interface gi0/0 | include Internet|Area
  Internet Address 10.12.0.2/30, Area 1

R1# show ip ospf neighbor
<no neighbors displayed>

Which configuration decision should fix the adjacency?

Options:

• A. Move R1 Gi0/0 into OSPF area 1.

• B. Configure a static route to 10.12.0.0/30 on R2.

• C. Configure ip ospf network point-to-point on R1 only.

• D. Configure ip ospf 10 area 0 on R2 Gi0/0.

Best answer: D

Explanation: OSPF neighbors on a directly connected link must agree on key interface parameters, including the OSPF area. The exhibit shows that Layer 3 reachability exists because the interfaces can ping, and the IPv4 addresses are in the same /30 subnet. The mismatch is that R1 places Gi0/0 in area 0 while R2 places its connected interface in area 1. Configuring OSPF area 0 on R2’s connected interface aligns the area with the stated single-area design and allows the adjacency process to proceed. Changing only the network type or adding static routing does not correct the area mismatch.

• Network type only fails because changing one side to point-to-point does not resolve the visible area mismatch.
• Move R1 to area 1 could align areas but violates the stated requirement to use area 0.
• Static route is unrelated because OSPF adjacency formation depends on matching OSPF interface parameters, not static reachability.

Question 86

Topic: IP Routing

R1 currently learns 2001:db8:50::/64 through OSPFv3 with administrative distance 110. You must configure an IPv6 floating static route that uses the backup neighbor only if the OSPFv3 route is removed. The backup neighbor’s next hop is FE80::3, reachable from R1 on GigabitEthernet0/1. Which IOS XE command meets the goal?

Options:

• A. ipv6 route 2001:db8:50::/64 GigabitEthernet0/1 FE80::3 120

• B. ipv6 route 2001:db8:50::/64 FE80::3 120

• C. ipv6 route 2001:db8:50::/128 GigabitEthernet0/1 FE80::3 120

• D. ipv6 route 2001:db8:50::/64 GigabitEthernet0/1 FE80::3 90

Best answer: A

Explanation: An IPv6 floating static route must be less preferred than the currently installed dynamic route, so its administrative distance must be higher than OSPFv3’s AD of 110. Because the next hop is a link-local IPv6 address, IOS XE also needs the outgoing interface to identify which link contains that neighbor. The route must match the destination network 2001:db8:50::/64, not a single host address. An AD such as 120 lets OSPFv3 remain active while it is present and allows the static route to take over only if the OSPFv3 route disappears.

• Omitting the interface fails because FE80::3 is link-local and only unique on a specific link.
• Using AD 90 fails because it would be preferred over the OSPFv3 route instead of floating.
• Using /128 fails because it creates a host route rather than a route to the remote LAN prefix.

Question 87

Topic: Network Infrastructure and Connectivity

A Cisco switch port connects to a lobby access point that should operate at 1 Gbps. The AP is set to auto-negotiate, supports 1 Gbps, and the cable has tested good. The site standard requires auto-negotiation on copper endpoints.

Exhibit:

SW1# show interfaces status | include Gi1/0/12
Gi1/0/12  AP-Lobby  connected  20  full  100  10/100/1000BaseTX

SW1# show running-config interface gi1/0/12
interface GigabitEthernet1/0/12
 switchport mode access
 switchport access vlan 20
 speed 100
 duplex full

Which configuration decision should restore the expected connection speed?

Options:

• A. Set Gi1/0/12 to auto-negotiate speed and duplex

• B. Convert Gi1/0/12 to an 802.1Q trunk

• C. Enable the VLAN 20 SVI with no shutdown

• D. Force Gi1/0/12 to speed 1000 duplex full

Best answer: A

Explanation: The evidence shows a speed mismatch with the expected connection: Gi1/0/12 is a GigabitEthernet copper port but is operating at 100 Mbps, and the running configuration explicitly forces speed 100. Because the AP is using auto-negotiation and the site standard requires auto-negotiation on copper endpoints, the switch port should not remain hardcoded. Restoring auto-negotiation for speed and duplex lets both sides agree on the best common setting, which should be 1 Gbps when the cable and endpoint support it.

Changing VLAN or trunk settings would not correct the physical-layer operational speed.

• Forced 1 Gbps violates the stated auto-negotiation standard and is not the best fix for an auto-negotiating copper endpoint.
• Trunk conversion changes Layer 2 VLAN tagging, not the physical interface speed.
• SVI enablement affects Layer 3 gateway reachability for VLAN 20, not the switch port’s negotiated speed.

Question 88

Topic: Network Infrastructure and Connectivity

Users in VLAN 30 report that new PCs receive APIPA addresses. The DHCP server is in VLAN 10 at 10.10.10.5 and has an active scope for 10.10.30.0/24.

Exhibit:

R1# show ip interface brief | include Vlan
Vlan10   10.10.10.1   YES manual up  up
Vlan30   10.10.30.1   YES manual up  up

R1# ping 10.10.10.5 source 10.10.30.1
!!!!!

R1# show running-config interface vlan30
interface Vlan30
 ip address 10.10.30.1 255.255.255.0

Which action best addresses the root cause?

Options:

• A. Change Vlan30 to an access switchport

• B. Create a new DHCP scope for VLAN 30

• C. Configure a default gateway on the DHCP server

• D. Configure ip helper-address 10.10.10.5 on Vlan30

Best answer: D

Explanation: DHCPv4 clients initially send broadcast messages, such as DHCPDISCOVER, because they do not yet have an IP address or know the DHCP server location. Routers do not forward these broadcasts by default. When the DHCP server is on a different subnet, the Layer 3 interface serving as the client subnet gateway must act as a DHCP relay. On Cisco IOS, this is commonly done with ip helper-address on the client-facing SVI or routed interface. The exhibit shows Vlan30 is up, routing to the server works, and the server already has a scope, so the missing relay configuration on Vlan30 is the supported cause.

• Server gateway is not supported because R1 can already reach the server when sourcing from the VLAN 30 gateway address.
• New scope is unnecessary because the stem states the DHCP server already has an active 10.10.30.0/24 scope.
• Access switchport is inappropriate because Vlan30 is an SVI providing Layer 3 gateway service, not a physical host port.

Question 89

Topic: Network Services and Security

A new branch office can reach Internet sites, but users cannot reach the HQ file server at 10.10.20.50. The branch has printers, VoIP phones, and PCs that all need access to HQ resources.

Clues:

What is the best corrective action?

Options:

• A. Configure PAT only on the branch edge router.

• B. Add a CNAME record for the HQ file server.

• C. Install remote-access VPN software on every branch device.

• D. Configure an IPsec site-to-site VPN between the edge routers.

Best answer: D

Explanation: An IPsec site-to-site VPN is appropriate when two locations need secure network-to-network connectivity over an untrusted network such as the Internet. In this case, the branch LAN has working DHCP, an up WAN link, and a default route for Internet access, but many device types need private access to HQ resources. Remote-access VPN works only for endpoints that can run a client, which does not fit printers, phones, and other shared devices. A site-to-site tunnel between the branch and HQ edge devices can protect traffic between the two private subnets transparently to the hosts.

• DNS change does not create encrypted connectivity to a private HQ subnet.
• PAT only supports outbound Internet access, not secure private network-to-network access.
• Remote-access clients are poorly suited for shared devices and do not connect the whole branch LAN.

Question 90

Topic: Network Infrastructure and Connectivity

A user connects a laptop to switch port Gi1/0/18 in VLAN 20. The laptop cannot ping its default gateway, but other VLAN 20 users on the same switch are working.

Exhibit:

Switch port: Gi1/0/18 up/up, access VLAN 20
VLAN 20 gateway: 192.168.20.1/24
Laptop IPv4: 192.168.30.45/24
Laptop default gateway: 192.168.20.1

Which configuration decision best addresses the problem?

Options:

• A. Change the VLAN 20 SVI to 192.168.30.1/24

• B. Convert Gi1/0/18 to an 802.1Q trunk

• C. Configure the laptop with a VLAN 20 IPv4 address

• D. Move Gi1/0/18 to access VLAN 30

Best answer: C

Explanation: The visible facts point to a client-side IPv4 configuration problem, not a switch or gateway infrastructure failure. The access port is up in VLAN 20, and other VLAN 20 clients can reach the network, so the VLAN and gateway are functioning. The laptop is using 192.168.30.45/24, which is not in the same subnet as the VLAN 20 gateway 192.168.20.1/24. A host normally needs an address in the local VLAN subnet, or a valid DHCP assignment for that subnet, to reach its default gateway directly. The correct fix is to configure the client for the VLAN 20 subnet.

• Moving the port to VLAN 30 follows the laptop’s wrong address instead of correcting the client for the assigned VLAN.
• Changing the SVI would disrupt working VLAN 20 users and is not supported by the evidence.
• Trunking is unnecessary for a single end-user laptop access connection.

Question 91

Topic: AI, Network Operations and Management

A network operations team is building a reusable prompt for a digital network assistant. The assistant will receive only sanitized show output and syslog excerpts for a VLAN reachability issue. The team wants the AI response to stay within the supplied evidence, avoid topology assumptions, and give operators checks to run before making changes. Which prompt instruction best meets these constraints?

Options:

• A. Infer the most likely root cause from common VLAN failures and recommend a fix.

• B. Use vendor best practices to redesign the VLAN and trunk configuration.

• C. Use only supplied evidence, flag gaps, and list validation commands before fixes.

• D. Provide the final configuration change first and include validation only if requested.

Best answer: C

Explanation: For CCNA-level AI-assisted operations, a good prompt limits the assistant to the evidence provided and requires it to separate confirmed facts from assumptions. The prompt should also tell the AI what to do when evidence is incomplete, such as flagging missing data instead of guessing. Because network changes can affect production connectivity, the response should include validation steps, such as relevant show, ping, traceroute, or log checks, before recommending changes. The key is not to make the AI more confident; it is to make the output traceable to network evidence and safe for an operator to verify.

• Common-failure inference is risky because it encourages guessing beyond the sanitized evidence.
• Best-practice redesign expands the scope beyond troubleshooting the provided VLAN issue.
• Fix-first output skips the required validation steps before operational changes.

Question 92

Topic: AI, Network Operations and Management

A network operations team must validate a time-service change on access switches. The engineer has confirmed SSH access and approved credentials for all devices. Based on the log excerpt, what is the best next action?

Exhibit: Operations log excerpt

10:05  SW-ACC-01# show ntp status
10:08  SW-ACC-02# show ntp status
10:12  SW-ACC-03# show ntp status
Task: run the same read-only command on 42 access switches
Required output: save per-device command results

Options:

• A. Replace the NTP configuration on all switches

• B. Continue SSHing to each switch manually

• C. Use Ansible to run the command across the inventory

• D. Open a console session to each switch

Best answer: C

Explanation: Ansible is well suited for repeatable command execution across multiple network devices when the task is consistent and the device list can be represented in an inventory. In this case, the exhibit shows the same read-only show ntp status command being run device by device, with identical output collection required for 42 switches. Using Ansible reduces manual repetition, improves consistency, and creates a repeatable record of command results without changing the configuration. Manual SSH might work for a few devices, but it is inefficient and more error-prone at this scale.

• Manual SSH fails because it repeats the same task 42 times and increases the chance of inconsistent collection.
• Console access is unnecessary because management SSH is already available.
• Configuration replacement is too aggressive because the task is validation, not remediation.

Question 93

Topic: AI, Network Operations and Management

A network team wants Ansible to collect show ip interface brief from all Cisco IOS XE routers in the branch_routers inventory group. The run must not change device configuration. Which configuration decision best meets the goal?

Options:

• A. Use ansible.builtin.command on the Ansible control node.

• B. Use cisco.ios.ios_config with show ip interface brief.

• C. Use cisco.ios.ios_command with host scope set to localhost.

• D. Use cisco.ios.ios_command with network_cli for branch_routers.

Best answer: D

Explanation: Ansible can manage Cisco IOS XE devices by targeting an inventory group and using Cisco network modules over a network connection such as network_cli. For read-only operational checks, cisco.ios.ios_command is the appropriate module because it sends show commands and returns output without applying configuration. The play should target branch_routers so the task runs against the routers in that inventory group, not only on the control node. Use ios_config when the goal is to push configuration lines, not when the requirement is only to collect show output.

• Configuration module is wrong because ios_config is intended for configuration changes, not read-only show command collection.
• Local command execution fails because ansible.builtin.command runs on the managed host or control context, not as an IOS XE network command module.
• Localhost scope fails because targeting localhost would not execute the command across the router inventory group.

Question 94

Topic: IP Routing

R1 and R2 are the only routers on a dedicated Ethernet link in OSPF area 0. OSPFv2 is already enabled on both link interfaces, and the routers form a FULL adjacency. The engineer wants the link to operate as OSPF point-to-point so no DR/BDR is elected, without changing addressing or area membership. Which configuration decision meets the goal?

Options:

• A. Configure static OSPF neighbor statements under OSPF.

• B. Configure ip ospf priority 0 on both link interfaces.

• C. Configure ip ospf network point-to-point on both link interfaces.

• D. Configure passive-interface for the link on both routers.

Best answer: C

Explanation: On a dedicated two-router Ethernet segment, OSPF can be configured as point-to-point when both sides support the same OSPF network type. The interface-level command ip ospf network point-to-point changes OSPF behavior for that link: the routers form a direct adjacency and do not elect a DR or BDR. The change should be applied consistently on both ends of the link so the neighbor relationship uses matching network-type behavior. This meets the goal without changing IP addresses, masks, process IDs, or area membership.

Changing OSPF priority affects DR eligibility on broadcast networks, but it does not make the interface point-to-point.

• Priority tuning affects DR/BDR eligibility but leaves the interface in a broadcast OSPF network type.
• Passive interface stops OSPF hellos, so it would break the existing neighbor adjacency.
• Static neighbors are used for specific nonbroadcast scenarios, not to convert an Ethernet OSPF link to point-to-point.

Question 95

Topic: Network Infrastructure and Connectivity

A network operations team is hosting two lightweight monitoring applications on a Linux server. Review the command output.

Exhibit:

$ uname -r
5.15.0-92-generic

$ docker exec netmon-web uname -r
5.15.0-92-generic

$ docker exec netmon-api uname -r
5.15.0-92-generic

What is the best interpretation of this output?

Options:

• A. The containers share the host OS kernel while keeping isolated application environments.

• B. Each container is running a separate guest operating-system kernel.

• C. The applications are not isolated because the kernel version matches.

• D. The host is running a type 1 hypervisor for both applications.

Best answer: A

Explanation: Containers provide lightweight application isolation by separating processes, filesystems, and network settings while sharing the host operating-system kernel. In the exhibit, the host and both containers report the same kernel version, which is expected for containers. Unlike virtual machines, containers do not boot a separate guest OS kernel for each workload, so they typically start faster and use fewer resources. Sharing the kernel does not mean there is no isolation; container runtimes use OS features such as namespaces and control groups to isolate and limit applications.

The key distinction is container isolation at the OS level versus VM isolation with separate guest operating systems.

• Separate guest kernel describes virtual machines, not standard containers.
• Type 1 hypervisor is not supported by the output; no hypervisor-based guest OS evidence is shown.
• No isolation confuses shared kernel behavior with the absence of process and filesystem isolation.

Question 96

Topic: Switching and Network Access

Two multilayer switches must use two physical links as one routed LACP connection for an OSPF point-to-point adjacency. The links are up, but the OSPF neighbor over Port-channel10 never forms.

Exhibit: SW1 checks

SW1# show etherchannel summary
Group  Port-channel  Protocol  Ports
10     Po10(SU)      LACP      Gi1/0/1(P) Gi1/0/2(P)

SW1# show interfaces port-channel10 switchport
Administrative Mode: trunk
Operational Mode: trunk

SW1# show ip interface brief | include Port-channel10
Port-channel10  unassigned  YES unset  up  up

Which corrective action best addresses the root cause?

Options:

• A. Convert the port-channel and members to routed ports.

• B. Create an SVI for the transit VLAN.

• C. Change LACP mode from active to on.

• D. Assign /30 addresses to both physical links.

Best answer: A

Explanation: The EtherChannel is operational, but it is operating as a Layer 2 trunk, shown by Po10(SU) and the switchport output. A routed LACP port-channel must be a Layer 3 interface, so the physical member interfaces and the port-channel should be configured with no switchport. The routed IP address belongs on Port-channel10, not on the individual member interfaces. After the peer is configured the same way with the matching subnet, OSPF can form over the logical routed interface.

The key distinction is that LACP bundles the links, but no switchport determines whether the bundle is used as a routed interface.

• Static EtherChannel fails because on disables LACP negotiation and does not fix the Layer 2 trunk state.
• SVI transit can route over a VLAN, but the requirement is a routed EtherChannel, not a trunk plus SVI design.
• Physical addressing breaks the single logical routed link model because member interfaces should not carry separate Layer 3 addresses.

Question 97

Topic: Switching and Network Access

An access switch uses Rapid PVST+ with two fiber trunks to the distribution layer. During a one-way fiber fault, Gi1/0/48 stayed up/up, stopped receiving BPDUs, and later began forwarding, causing MAC flaps.

Normal STP state:
Gi1/0/47  Root  FWD
Gi1/0/48  Altn  BLK

Symptom during fault:
%SW_MATM-4-MACFLAP_NOTIF: Host flapping between Gi1/0/47 and Gi1/0/48

Which corrective action best protects this redundant trunk from forwarding when expected BPDUs are missing?

Options:

• A. Enable PortFast on Gi1/0/48.

• B. Enable root guard on Gi1/0/47.

• C. Enable BPDU guard on Gi1/0/48.

• D. Enable loop guard on Gi1/0/48.

Best answer: D

Explanation: Loop guard is the Rapid PVST+ protection feature used when a port that should receive BPDUs might stop receiving them because of a unidirectional link or similar failure. On a redundant trunk in an alternate or root role, missing BPDUs can make STP believe the path is safe and move the port toward forwarding, which can create a Layer 2 loop. Loop guard prevents that by placing the affected non-designated port into a loop-inconsistent state until BPDUs are received again.

BPDU guard and PortFast are edge-port features, while root guard protects against superior BPDUs on ports where the root bridge should not appear.

• BPDU guard is for PortFast edge ports and err-disables a port that receives BPDUs, not one that stops receiving them.
• PortFast would make a trunk converge too aggressively and does not protect against missing BPDUs.
• Root guard blocks superior BPDUs from an unexpected root, which is not the symptom shown.

Question 98

Topic: Switching and Network Access

A switch runs Rapid PVST+. Interface Gi1/0/12 connects to a single desktop PC in VLAN 20 and must begin forwarding quickly after link-up. The change must apply only to this edge port and must not affect uplinks or trunks. Which interface configuration is best?

Options:

• A. switchport mode access and spanning-tree portfast

• B. switchport mode trunk and spanning-tree portfast trunk

• C. spanning-tree bpduguard enable only

• D. spanning-tree portfast default in global configuration

Best answer: A

Explanation: PortFast is used on Layer 2 edge ports that connect to end hosts, such as PCs, printers, or servers. On an access port, spanning-tree portfast lets the port bypass the normal listening/learning delay and move quickly to forwarding while still participating in STP if a BPDU is received. Because the requirement applies only to Gi1/0/12, the best scope is interface configuration, not a global default. The port should remain an access port for the desktop VLAN rather than being treated as a trunk.

• Global default affects all nontrunking ports, which is broader than the stated one-port requirement.
• Trunk PortFast is intended only for specific trunk edge cases, not a normal desktop access port.
• BPDU Guard alone protects an edge port from unexpected BPDUs but does not make the port transition quickly to forwarding.

Question 99

Topic: Switching and Network Access

A switch port connects to a Cisco IP phone, and a user PC connects to the phone’s built-in switch port. The PC must be in VLAN 10, and the phone must be in VLAN 110. The port should support both devices while keeping data and voice traffic separated. Which switch-port attribute set should be configured?

Options:

• A. Access mode, access VLAN 10, voice VLAN 110

• B. Access mode, access VLAN 110 only

• C. Routed port with IP addressing for VLAN 10

• D. Trunk mode, native VLAN 10, allowed VLANs 10 and 110

Best answer: A

Explanation: For a Cisco IP phone with a PC connected behind it, the switch port is normally configured as a Layer 2 access port. The switchport access vlan value places the PC’s untagged data traffic into the data VLAN. The switchport voice vlan value tells the phone to use the voice VLAN, typically tagging voice frames while the PC traffic remains untagged. This supports both endpoints on one physical switch port without making the port a general-purpose trunk. A trunk could carry both VLANs, but it is not the standard edge-port configuration for a phone-plus-PC connection at CCNA depth.

• Trunk mode is unnecessary for a typical phone edge port and changes the port scope from access-host behavior.
• Voice VLAN only fails because the PC’s data VLAN is not configured.
• Routed port removes Layer 2 switch-port behavior and cannot provide separate access and voice VLAN attributes.

Question 100

Topic: Network Infrastructure and Connectivity

A technician is configuring the management SVI on an IOS XE switch. The management subnet is 172.16.18.64/27, and the router already uses 172.16.18.65 as the default gateway. Which SVI address configuration meets the requirement?

Options:

• A. ip address 172.16.18.66 255.255.255.224

• B. ip address 172.16.18.63 255.255.255.224

• C. ip address 172.16.18.95 255.255.255.224

• D. ip address 172.16.18.64 255.255.255.224

Best answer: A

Explanation: The mask 255.255.255.224 is /27, which creates block sizes of 32 addresses in the last octet. The subnet that starts at 172.16.18.64 runs through 172.16.18.95. The subnet ID is .64, the broadcast address is .95, and usable host addresses are .65 through .94. Because .65 is already assigned to the router gateway, the SVI needs another usable address in that range. The address .66 is in the correct subnet and is not reserved.

• Previous subnet fails because .63 is outside the 172.16.18.64/27 subnet.
• Subnet ID fails because .64 identifies the subnet and cannot be assigned to a host.
• Broadcast address fails because .95 is the directed broadcast address for this /27 subnet.

Review your attempt

Use your missed questions to identify a specific decision to revisit: an address boundary, route, interface state, security requirement or interpretation of output. Reproduce relevant tasks in a lab and use fresh scenarios to check understanding. A familiar-set score is not a pass prediction.

Continue in the web app

Use IT Mastery for interactive Cisco CCNA 200-301 v2.0 practice with mixed sets, timed mocks, topic drills, explanations, and progress tracking.

Try Cisco CCNA 200-301 v2.0 on Web